SSE-Engineer Prisma Access Services Practice Test 3 — 15 Questions

Question 1

A Prisma Access administrator is troubleshooting why mobile users are unable to access a specific SaaS application. The administrator has confirmed that the application is allowed in the security policy and that GlobalProtect is connected. Which log type should the administrator examine to determine if the SaaS application is being identified and if any CASB policies are blocking it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CASB logs. CASB logs are specifically designed to record CASB policy enforcement events, including which SaaS application was accessed, the user, the action taken, and the policy that matched. When troubleshooting CASB-related access issues, these logs provide the necessary details to determine if a CASB policy is blocking the application.

Answer

Traffic logs

Answer

SaaS Application Usage logs

Answer

URL Filtering logs

Question 2

An administrator is configuring Prisma Access to enforce Data Loss Prevention (DLP) policies for mobile users uploading files to SaaS applications. The administrator has created a DLP profile in Prisma Access and attached it to a security policy rule. However, DLP is not detecting sensitive data in files uploaded via HTTPS. The administrator has confirmed that SSL decryption is enabled for the traffic. What is the most likely reason DLP is not inspecting the files?

Accepted Answer

The DLP profile is configured to inspect only file downloads, not uploads.. DLP profiles can be configured to inspect traffic in specific directions, such as upload or download. If the profile is set to inspect only downloads, file uploads to SaaS applications will not be scanned for sensitive data. The administrator should verify that the DLP profile includes upload direction rules or is applied bidirectionally to ensure uploads are inspected.

Answer

The security policy rule does not have a File Blocking profile attached, which is required for DLP to inspect file uploads.

Answer

The DLP profile is configured to only inspect HTTP traffic, not HTTPS.

Answer

The SaaS applications are using certificate pinning, which prevents Prisma Access from decrypting the traffic.

Question 3

A security engineer is deploying Prisma Access for a remote branch office that uses a single IPsec tunnel to a Prisma Access service connection. The branch has two ISP links and requires automatic failover if the primary link degrades, without re-establishing the IPsec tunnel to a different Prisma Access node. Which Prisma Access configuration should the engineer implement?

Accepted Answer

Configure two separate IPsec tunnels from the branch to the same Prisma Access service connection, each using a different ISP link, and enable ECMP with path monitoring.. Prisma Access service connections allow multiple IPsec tunnels from the same branch to the same service connection node. When the branch CPE supports ECMP with path monitoring, it can distribute traffic across both ISP links and detect failures, providing automatic failover without re-establishing tunnels to a different node. This is the recommended design for branch high availability with dual ISPs.

Answer

Configure a single IPsec tunnel with multiple proxy IDs and enable path monitoring on the tunnel interface.

Answer

Configure a single IPsec tunnel to Prisma Access and enable IKEv2 fragmentation to handle link degradation.

Answer

Configure a single IPsec tunnel to Prisma Access with a backup gateway defined in the IKE gateway settings.

Question 4

A security engineer is configuring Prisma Access for a remote network that uses a dynamic public IP address. The remote network's ISP assigns a new IP address every 24 hours. The engineer wants to ensure that the IPsec tunnel to Prisma Access remains operational despite the IP change. What should the engineer configure?

Accepted Answer

Configure the remote network to use a dynamic DNS (DDNS) hostname and set up the IPsec tunnel with IKEv2, using the DDNS hostname as the peer address in Prisma Access.. To maintain an IPsec tunnel with a remote network that has a dynamic public IP, you should use a dynamic DNS hostname that tracks the IP changes. In Prisma Access, configure the remote network with this DDNS hostname as the peer address. The remote network initiates the tunnel with IKEv2, and Prisma Access resolves the hostname to establish the connection, ensuring continuous operation even when the IP changes.

Answer

Configure the remote network to use IKEv2 with 'Dynamic Peer' and set the local and peer identities to match the dynamic IP using pre-shared keys.

Answer

Configure the remote network with a static IP address and disable DHCP on the ISP link.

Answer

Use IKEv2 with 'Aggressive Mode' and configure the remote network to use a dynamic DNS (DDNS) hostname for the peer address.

Question 5

A network engineer is configuring a Service Connection in Prisma Access to connect the cloud security infrastructure back to the corporate data center. Which routing protocol is supported natively by Prisma Access to dynamically exchange routes over the IPsec VPN tunnel?

Accepted Answer

BGP. Prisma Access supports BGP (Border Gateway Protocol) over IPsec for dynamic routing on Service Connections and Remote Networks.

Answer

EIGRP

Answer

RIPv2

Answer

OSPF

Question 6

An administrator wants to deploy Secure Web Gateway (SWG) capabilities in Prisma Access to prevent users from uploading company proprietary data to unauthorized cloud storage applications. Which Prisma Access profile type should be applied to the Security Policy rules to achieve this?

Accepted Answer

Data Filtering profile. Data Filtering profiles in Prisma Access are specifically designed to inspect traffic for sensitive data patterns (such as credit card numbers, SSNs, or custom data patterns) and to control uploads/downloads to SaaS applications. To block proprietary data uploads to unauthorized cloud storage, the Data Filtering profile is attached to the Security Policy rule alongside the App-ID for the cloud storage app. URL Filtering and Antivirus profiles do not perform content-based data pattern matching.

Answer

Zone Protection profile

Answer

Antivirus profile

Answer

URL Filtering profile

Question 7

An administrator notices that certain mobile users connecting via Prisma Access are experiencing intermittent authentication timeouts when authenticating via SAML 2.0. Where should the administrator check to verify the Identity Provider (IdP) connectivity status and SAML assertion errors within Panorama?

Accepted Answer

Monitor -> Logs -> Authentication. SAML 2.0 authentication events, including IdP connectivity failures and assertion errors, are logged in the Authentication log, accessible via Monitor > Logs > Authentication in Panorama. This log captures the full SAML exchange, including IdP response status, assertion validation errors, and timeout reasons, making it the correct place to diagnose intermittent authentication timeouts.

Answer

Monitor -> Traffic -> Session End

Answer

Objects -> Authentication -> SAML Test

Answer

Panorama -> Cloud Services -> Health -> Infrastructure

Question 8

A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?

Accepted Answer

HTTP Header Insertion / Restricted Tenant Access. App-ID SaaS Security controls and HTTP header insertion (specifically restricted domains/tenant restriction headers) allow Prisma Access to enforce access only to approved enterprise tenants.

Answer

Prisma Access DNS Security sinking

Answer

GlobalProtect Client-less VPN rewriting rules

Answer

SaaS Security API inline scanning

Question 9

Which log type in Prisma Access should an administrator examine to review details about blocked URLs, category ratings, and user web-browsing attempts?

Accepted Answer

URL Filtering log. The URL Filtering log in Prisma Access records every web-browsing session that matches a URL Filtering profile, including the URL category, the action taken (allow/block/continue/override), the user, and the source. This is the only log type that directly captures blocked URLs and category ratings for user web attempts.

Answer

Threat log

Answer

Data Filtering log

Answer

HIP Match log

Question 10

Which Prisma Access service capability provides secure, least-privilege remote access for third-party contractors who cannot install the GlobalProtect agent on their managed or unmanaged devices?

Accepted Answer

GlobalProtect Client-less VPN. GlobalProtect Client-less VPN provides browser-based access to internal web applications without requiring an endpoint client.

Answer

Prisma Access Remote Network IPsec

Answer

Prisma Access Browser

Answer

Explicit Proxy Forwarding

Question 11

An administrator is configuring Prisma Access Secure Web Gateway and wants to ensure that newly registered malicious domains are blocked automatically without waiting for manual signature updates. Which Palo Alto Networks security service provides real-time IP and domain threat intelligence to Prisma Access?

Accepted Answer

DNS Security. DNS Security is the Palo Alto Networks cloud-delivered service that provides real-time threat intelligence for DNS queries, using predictive analytics and machine learning to block newly registered malicious domains (NRDs) and DNS tunneling without waiting for manual signature updates. It integrates natively with Prisma Access Secure Web Gateway to inspect DNS traffic inline and enforce sinkhole or block actions. This real-time, dynamic feed is exactly what the question describes.

Answer

Prisma Access Insights

Answer

SaaS Security API

Answer

GlobalProtect Cloud Service Agent

Question 12

An enterprise is deploying Prisma Access and wants to ensure that user identity mapping is gathered efficiently from Microsoft Entra ID (formerly Azure AD) without deploying physical User-ID agents inside the cloud network. Which integration method should be used?

Accepted Answer

Cloud Identity Engine (CIE). Cloud Identity Engine (CIE) is Palo Alto Networks' cloud-delivered identity service that ingests user identity from Microsoft Entra ID (and other IdPs) via API, without requiring on-premises User-ID agents. It maps users to IP addresses and groups and publishes that mapping to Prisma Access, enabling policy enforcement based on user identity. This is the recommended integration for cloud-only or agentless identity mapping.

Answer

WMI probing from Prisma Access nodes

Answer

GlobalProtect client registry polling

Answer

Syslog server parsing via Service Connection

Question 13

An administrator is troubleshooting a CASB inline policy where a specific file upload to an unapproved SaaS application was not blocked. Upon checking the Security policy, the rule has the correct application identified. What is the most likely reason the inline action failed to trigger?

Accepted Answer

SSL Decryption is disabled for the traffic flow.. CASB inline policies in Prisma Access rely on the firewall's content inspection engine to identify files and apply actions. If SSL Decryption is not enabled for the traffic flow, the firewall cannot see inside the TLS session, so it cannot identify the file upload or match the inline CASB policy. The rule may show the correct application, but without decryption the file-level action cannot trigger.

Answer

The GlobalProtect agent version is outdated.

Answer

The User-ID agent is offline.

Answer

SaaS Security API sync interval needs to be refreshed.

Question 14

An administrator configuring Prisma Access ZTNA wants to view real-time metrics regarding active mobile user connections, bandwidth consumption per region, and tunnel status. Which tool provides this specific operational dashboard?

Accepted Answer

Prisma Access Insights. Prisma Access Insights is the dedicated cloud-based analytics and monitoring service that provides real-time and historical operational dashboards for Prisma Access, including mobile user connection counts, per-region bandwidth utilization, and tunnel/health status. It aggregates telemetry from all Prisma Access components (mobile users, remote networks, service connections) into a single pane of glass, which is exactly what the administrator needs.

Answer

Panorama Traffic Logs

Answer

Command Line Interface (CLI) via SSH to Prisma Access nodes

Answer

Prisma Cloud Compute console

Question 15

A security engineer is configuring a Prisma Access Remote Network location with redundant IPsec tunnels to ensure high availability. What configuration requirement must be met on the customer premise equipment (CPE) router to support dynamic routing over these redundant tunnels?

Accepted Answer

BGP peering must be established across both tunnels with the Prisma Access service node.. To support dynamic routing over redundant IPsec tunnels between a CPE router and Prisma Access, BGP peering must be established across both tunnels. Prisma Access uses BGP to exchange routes and detect failures, enabling automatic failover and load sharing. Without BGP, the CPE cannot dynamically learn routes or react to tunnel failures.

Answer

Static floating routes with identical metrics must be used.

Answer

OSPF area 0 must be configured on the CPE interface.

Answer

GRE encapsulation must wrap the IPsec packets.