SSE-Engineer Prisma Access Services Practice Test 3 — 15 Questions

Question 1

Which log category in Prisma Access records events when a user's host information profile (HIP) changes or fails a compliance check?

Accepted Answer

HIP Match log. HIP Match logs record endpoint compliance evaluation results.

Answer

System log

Answer

Configuration log

Answer

User-ID log

Question 2

An administrator is troubleshooting a Prisma Access deployment where mobile users are intermittently disconnected when moving between trusted Wi-Fi networks and cellular connections. Which GlobalProtect client setting in Prisma Access helps maintain session persistence and fast reconnection during network roaming?

Accepted Answer

GlobalProtect App configuration with seamless tunnel reconnection and 'Always On' mode. GlobalProtect app settings such as 'Connect Method' set to 'Always On' or 'Pre-Logon' along with seamless tunnel reconnection settings ensure persistent connections.

Answer

Explicit Proxy PAC file fallback mode

Answer

BGP route dampening on the Service Connection

Answer

IPsec Dead Peer Detection (DPD) timer set to zero

Question 3

Which Prisma Access feature enables enterprises to inspect and secure traffic between different virtual networks or cloud environments connected to the cloud service?

Accepted Answer

Firewall as a Service (FWaaS). Firewall as a Service (FWaaS) provides comprehensive Layer 7 inspection for all traffic traversing Prisma Access.

Answer

CASB API scanning

Answer

Prisma Access Insights

Answer

GlobalProtect Portal

Question 4

An enterprise wants to ensure that all internet-bound traffic from mobile users is decrypted and inspected for malware and sensitive data using Prisma Access SWG. Which GlobalProtect client traffic forwarding configuration ensures that all traffic is sent to Prisma Access?

Accepted Answer

Tunnel All Traffic mode. Tunnel all traffic mode routes all client traffic through the secure GlobalProtect tunnel to Prisma Access.

Answer

Explicit Proxy local bypass mode

Answer

Split Tunnel mode based on destination subnets

Answer

Client-less Portal mode

Question 5

An administrator is configuring Prisma Access Remote Networks to connect branch offices to the cloud security backbone. Which TWO configuration steps are required on Panorama to establish a functional Remote Network connection? (Choose two)

Accepted Answer

Configure IPsec Crypto Profiles and Tunnel settings for the Remote Network connection.. Configuring Remote Networks requires defining the remote network location with public IP/bandwidth and creating IPsec tunnel parameters to establish the secure connection.

Answer

Upload customer SAML metadata files to the GlobalProtect Portal.

Answer

Configure WMI probing credentials for Active Directory domain controllers.

Answer

Install the GlobalProtect agent software on all CPE branch routers.

Question 6

An organization is deploying Prisma Access CASB and Secure Web Gateway features. Which THREE capabilities are provided by Prisma Access Inline CASB compared to out-of-band SaaS Security API? (Choose three)

Accepted Answer

Real-time blocking of unauthorized data uploads to sanctioned and unsanctioned cloud applications.. Inline CASB inspects traffic in real time, blocks unauthorized uploads/downloads immediately, and enforces tenant restriction headers.

Answer

Deep historical scanning of files at rest stored within cloud SaaS storage repositories.

Answer

Out-of-band remediation of externally shared links via API webhooks.

Question 7

An administrator is troubleshooting ZTNA connectivity issues for mobile users connecting via Prisma Access. Which TWO tools or log types in Panorama should the administrator check to diagnose user authentication and tunnel establishment problems? (Choose two)

Accepted Answer

System log. System logs and Authentication logs provide visibility into mobile user login events, GlobalProtect connection handshakes, and SAML/LDAP authentication results.

Answer

WildFire submission log

Answer

HIP Match log

Answer

Data Filtering log

Question 8

A security architect is designing a Prisma Access FWaaS deployment and needs to ensure robust security posture across all zones (Mobile Users, Remote Networks, Service Connections, and Internet). Which THREE security profile types should be attached to Security Policy rules to ensure comprehensive threat prevention? (Choose three)

Accepted Answer

Vulnerability Protection Security Profile. Comprehensive threat prevention in PAN-OS / Prisma Access relies on Antivirus, Vulnerability Protection, and WildFire Analysis profiles.

Answer

GlobalProtect Portal Configuration Profile

Answer

Cloud Services Dynamic Template

Question 9

An administrator is configuring Prisma Access Secure Web Gateway and wants to restrict access to high-risk web categories. Which TWO options represent configurable actions within a Prisma Access URL Filtering profile? (Choose two)

Accepted Answer

Continue. URL Filtering profiles support multiple actions per category, including Allow, Block, Alert, Continue, and Override.

Answer

Decrypt

Answer

Sandbox

Answer

Quarantine

Question 10

An enterprise is integrating Prisma Access with their corporate infrastructure. Which THREE components can be connected to Prisma Access to provide centralized cloud security inspection? (Choose three)

Accepted Answer

Service Connections (corporate data centers or headquarters). Prisma Access connects Mobile Users, Remote Networks (branch offices), and Service Connections (data centers/HQ).

Answer

Local standalone firewalls operating in hardware bypass mode without cloud connection

Answer

Public cloud VPCs directly via automated cloud connectors without IPsec or BGP

Question 11

An administrator needs to configure Prisma Access ZTNA to verify endpoint hygiene before granting access to internal applications. Which TWO posture checks can be evaluated using GlobalProtect Host Information Profiles (HIP)? (Choose two)

Accepted Answer

Antivirus presence and definition update status. HIP profiles evaluate endpoint security parameters including disk encryption status, antivirus installation, OS patch levels, and software inventory.

Answer

Active Directory group membership hierarchy

Answer

BGP route advertisement metrics

Answer

SAML Identity Provider multi-factor authentication token validity

Question 12

An administrator is configuring Prisma Access SWG and needs to implement granular control over file sharing and collaboration tools. Which TWO SaaS Security features can be configured in Prisma Access to achieve this? (Choose two)

Accepted Answer

Shadow IT discovery and risk scoring of unapproved cloud applications. Prisma Access CASB allows administrators to discover shadow IT, control tenant access, and inspect file activities.

Answer

IPsec crypto profile selection for branch offices

Answer

GlobalProtect client software version deployment rules

Answer

WMI-based user mapping polling intervals

Question 13

An enterprise is planning a Prisma Access deployment and wants to optimize performance and redundancy for Remote Networks. Which THREE best practices should the network architect follow when designing IPsec connections to Prisma Access? (Choose three)

Accepted Answer

Configure redundant IPsec tunnels from separate CPE devices or diverse ISP connections to Prisma Access.. Best practices for Remote Networks include configuring redundant tunnels, enabling BGP for dynamic routing, and selecting appropriate MTU/MSS settings.

Answer

Disable Dead Peer Detection (DPD) to keep tunnels permanently active.

Answer

Use OSPF area 0 across all IPsec tunnels to establish fast convergence.

Question 14

An administrator wants to ensure high availability and resilient connectivity for mobile users connecting to Prisma Access. Which TWO features or mechanisms are utilized by Prisma Access to ensure reliable mobile user access? (Choose two)

Accepted Answer

Cloud-scale redundant gateway architecture across multiple geographic locations. Prisma Access provides mobile user high availability via automated gateway selection, regional redundancy, and client reconnect capabilities.

Answer

Static routing tables configured locally on Windows and macOS registry settings

Answer

Manual IPsec tunnel failover scripting executed on each endpoint device

Answer

On-premise physical hardware load balancers deployed in front of mobile user tunnels

Question 15

A security engineer is troubleshooting traffic inspection issues in Prisma Access FWaaS. Traffic between two mobile users is bypassing security policy inspection. Which THREE factors could cause intra-zone or inter-user traffic to bypass security inspection in Prisma Access? (Choose three)

Accepted Answer

Security policy rules configured with the 'App-Override' or custom bypass settings for specific applications.. Traffic bypassing inspection can be caused by explicit decryption bypass rules, clientless or split-tunnel configurations, or specific application bypass features.

Answer

GlobalProtect portal banner message customization.

Answer

Panorama template commit pending status on Remote Networks.