SSE-Engineer Prisma Access Services Practice Test 4 — 15 Questions

Question 1

When designing a Prisma Access deployment for remote workers, which component authenticates the user and assigns the appropriate GlobalProtect gateway connection based on geographic location?

Accepted Answer

GlobalProtect Portal. The GlobalProtect Portal is the component that authenticates remote users and assigns the appropriate GlobalProtect gateway based on geographic location. It presents the login page, performs authentication (via SAML, LDAP, RADIUS, etc.), and returns the gateway list or a specific gateway to the client based on the user's region, source IP, or other criteria. This is the standard Prisma Access remote-worker design.

Answer

Service Connection

Answer

GlobalProtect Gateway

Answer

Remote Network

Question 2

An organization requires that all DNS queries from Prisma Access mobile users be inspected and filtered for malicious domains before resolving. Where in Panorama is Prisma Access DNS Security configured?

Accepted Answer

Objects -> Security Profiles -> DNS Security. DNS Security profiles are attached to Security Policy rules in Panorama to inspect and take action on DNS requests.

Answer

Policies -> NAT

Answer

Panorama -> Cloud Services -> GlobalProtect -> DNS

Answer

Network Services -> DNS Proxy

Question 3

Which security feature in Prisma Access SWG inspects downloaded executable files and documents against a cloud-based behavioral sandbox to identify zero-day malware?

Accepted Answer

WildFire. WildFire is Palo Alto Networks cloud-based malware analysis and sandbox engine.

Answer

Data Filtering

Answer

URL Filtering

Answer

Antivirus Profile

Question 4

When configuring Prisma Access via Panorama, which administrative role or permission is required to push configuration changes to the cloud infrastructure?

Accepted Answer

Panorama Administrator role with Cloud Services plugin permissions. Pushing configuration from Panorama to Prisma Access requires the Panorama Administrator role combined with Cloud Services plugin permissions, because the Cloud Services plugin is what brokers communication between Panorama and the Prisma Access cloud infrastructure. Without those plugin-level permissions, the admin can edit Panorama objects but cannot commit or push them to the cloud tenant. This role pairing is what authorizes the 'Push to Devices' / 'Commit to Prisma Access' workflow.

Answer

Network Administrator without Cloud Services access

Answer

Prisma Cloud Administrator

Answer

GlobalProtect Read-Only Operator

Question 5

An administrator is setting up Prisma Access and needs to ensure that mobile users connecting from managed corporate laptops can access internal resources, while unmanaged contractor laptops are restricted to web-based applications only. Which Prisma Access mechanism distinguishes between managed and unmanaged endpoints during connection?

Accepted Answer

GlobalProtect HIP (Host Information Profile) checks. GlobalProtect HIP (Host Information Profile) checks collect endpoint posture data — such as whether the device is domain-joined, has the corporate certificate, or runs required security software — and Prisma Access uses HIP profiles in security policy to distinguish managed corporate laptops from unmanaged contractor devices. This allows different access levels per endpoint type.

Answer

SAML Identity Provider group claims

Answer

Active Directory Security Group membership only

Answer

Prisma Access Explicit Proxy PAC file routing

Question 6

An organization is deploying Prisma Access for mobile users and needs to ensure that users in Europe connect to European cloud nodes while users in North America connect to North American nodes. How does Prisma Access automatically achieve this geographic routing?

Accepted Answer

GlobalProtect cloud DNS resolution and regional gateway priority settings. Prisma Access uses GlobalProtect cloud DNS resolution and regional gateway priority settings to automatically route users to the nearest regional cloud node. When a mobile user connects, GlobalProtect resolves the closest gateway based on the user's source IP geolocation and the configured priority of gateways in each region. This is automatic and requires no manual per-laptop configuration.

Answer

Active Directory site-to-site replication

Answer

Explicit Proxy PAC file geographic strings

Answer

Manual IP routing configuration on each user laptop

Question 7

An enterprise using Prisma Access has configured a Service Connection to their primary data center. Users at remote branches report that they cannot reach internal applications hosted in the data center. Upon checking Panorama, the Service Connection status shows 'Connected', but routing is failing. What configuration step is required on Prisma Access to advertise the remote network subnets to the data center?

Accepted Answer

Configure BGP peer settings and export rules on the Service Connection in Panorama.. The Service Connection in Prisma Access uses a secure tunnel (IPsec) to the data center, and routing information must be exchanged dynamically. BGP is the supported routing protocol for Service Connections, and export rules determine which remote network subnets (branch/remote user networks) are advertised to the data center. Without configuring BGP peer settings and export rules, the data center will not learn the routes to the remote subnets, causing connectivity failures even though the tunnel is 'Connected'.

Answer

Enable SSL Decryption on the Service Connection interface.

Answer

Create a GlobalProtect Portal authentication profile for the data center.

Answer

Configure Zone Protection profiles on the tunnel interface.

Question 8

An administrator wants to configure Prisma Access Secure Web Gateway to block access to sites categorized as 'Gambling' during working hours, but allow them during lunch breaks. Which Panorama feature enables time-based policy enforcement?

Accepted Answer

Schedule Objects applied to Security Policy rules. Time-based policy enforcement in Panorama is achieved using Schedule Objects applied to Security Policy rules. A schedule defines specific days and times, and when attached to a rule, the rule is active only during those times, allowing Gambling sites to be blocked during working hours and allowed during lunch breaks.

Answer

Prisma Access Insights time-window filters

Answer

URL Filtering custom time-out profiles

Answer

GlobalProtect Portal connection timers

Question 9

Which log category in Prisma Access records events when a user's host information profile (HIP) changes or fails a compliance check?

Accepted Answer

HIP Match log. The HIP Match log records events related to Host Information Profile (HIP) checks, including when a user's HIP data changes or when the endpoint fails a compliance check defined in a HIP-enabled security policy. It is the specific log category used to audit endpoint compliance posture and HIP-based policy enforcement. Other log types cover different event classes and do not capture HIP match results.

Answer

System log

Answer

Configuration log

Answer

User-ID log

Question 10

An administrator is troubleshooting a Prisma Access deployment where mobile users are intermittently disconnected when moving between trusted Wi-Fi networks and cellular connections. Which GlobalProtect client setting in Prisma Access helps maintain session persistence and fast reconnection during network roaming?

Accepted Answer

GlobalProtect App configuration with seamless tunnel reconnection and 'Always On' mode. GlobalProtect App configuration with seamless tunnel reconnection and 'Always On' mode maintains the tunnel across network changes by automatically re-establishing the connection when the underlying network switches (Wi-Fi to cellular). Always On ensures the tunnel is brought up without user intervention, and seamless reconnection minimizes disruption during roaming. This is the client-side setting that addresses session persistence.

Answer

Explicit Proxy PAC file fallback mode

Answer

BGP route dampening on the Service Connection

Answer

IPsec Dead Peer Detection (DPD) timer set to zero

Question 11

Which Prisma Access feature enables enterprises to inspect and secure traffic between different virtual networks or cloud environments connected to the cloud service?

Accepted Answer

Firewall as a Service (FWaaS). Firewall as a Service (FWaaS) in Prisma Access provides Layer 3/4 and Layer 7 inspection for traffic traversing between virtual networks, cloud environments, and remote sites connected to the Prisma Access cloud. It applies the same security policy stack (App-ID, Threat Prevention, WildFire) to east-west and north-south traffic in the cloud.

Answer

CASB API scanning

Answer

Prisma Access Insights

Answer

GlobalProtect Portal

Question 12

An enterprise wants to ensure that all internet-bound traffic from mobile users is decrypted and inspected for malware and sensitive data using Prisma Access SWG. Which GlobalProtect client traffic forwarding configuration ensures that all traffic is sent to Prisma Access?

Accepted Answer

Tunnel All Traffic mode. Tunnel All Traffic mode in GlobalProtect forces all client traffic, including internet-bound traffic, through the Prisma Access tunnel, ensuring it is decrypted and inspected by SWG. This is the configuration that guarantees no traffic bypasses Prisma Access.

Answer

Explicit Proxy local bypass mode

Answer

Split Tunnel mode based on destination subnets

Answer

Client-less Portal mode

Question 13

An administrator is configuring Prisma Access Remote Networks to connect branch offices to the cloud security backbone. Which TWO configuration steps are required on Panorama to establish a functional Remote Network connection? (Choose two)

Accepted Answer

Configure IPsec Crypto Profiles and Tunnel settings for the Remote Network connection.. Option B is correct because a Remote Network connection in Prisma Access is an IPsec tunnel terminated by the branch CPE, so Panorama requires IPsec Crypto Profiles (IKE and IPSec proposals) and tunnel settings (IKE gateway, tunnel interface, and tunnel monitor) to build that secure connection. Option C is correct because the Remote Network general settings must define the region, the bandwidth/license allocation, and the public IP address of the CPE device so the Prisma Access service can identify and size the branch tunnel endpoint. Option A is not required because SAML metadata upload to the GlobalProtect Portal applies to remote user (mobile user) authentication, not to Remote Network IPsec tunnels. Option D is not required because WMI probing credentials are used for User-ID/domain controller monitoring, which is unrelated to establishing a Remote Network tunnel. Option E is not required because Remote Networks use IPsec-capable CPE routers, not the GlobalProtect agent, which is installed on end-user endpoints for mobile users.

Answer

Upload customer SAML metadata files to the GlobalProtect Portal.

Answer

Configure WMI probing credentials for Active Directory domain controllers.

Answer

Install the GlobalProtect agent software on all CPE branch routers.

Question 14

An organization is deploying Prisma Access CASB and Secure Web Gateway features. Which THREE capabilities are provided by Prisma Access Inline CASB compared to out-of-band SaaS Security API? (Choose three)

Accepted Answer

Real-time blocking of unauthorized data uploads to sanctioned and unsanctioned cloud applications.. Inline CASB in Prisma Access inspects traffic in real time as users browse, so option C is correct: it can block unauthorized data uploads to both sanctioned and unsanctioned cloud applications before the data leaves the network. Option D is correct because inline CASB can insert tenant restriction headers (e.g., the Microsoft 365 tenant restriction HTTP header) to ensure users only access the organization's own tenant and not personal or foreign tenants. Option E is correct because inline inspection scans downloads in the traffic path and can immediately prevent malware from being downloaded from cloud storage platforms during browsing. Options A and B are not correct for inline CASB: deep historical scanning of files at rest (A) and out-of-band remediation of externally shared links via API webhooks (B) are capabilities of the API-based, out-of-band SaaS Security API, not the inline proxy-based CASB.

Answer

Deep historical scanning of files at rest stored within cloud SaaS storage repositories.

Answer

Out-of-band remediation of externally shared links via API webhooks.

Question 15

An administrator is troubleshooting ZTNA connectivity issues for mobile users connecting via Prisma Access. Which TWO tools or log types in Panorama should the administrator check to diagnose user authentication and tunnel establishment problems? (Choose two)

Accepted Answer

System log. The System log (B) is correct because it records system-level events on Prisma Access components, including GlobalProtect/ZTNA tunnel establishment, gateway selection, and connection failures, which are essential for diagnosing tunnel setup problems. The Authentication log (E) is correct because it captures user authentication events such as portal/gateway logins, SSO/SAML exchanges, and MFA results, directly addressing user authentication issues. WildFire submission log (A) only shows files/URLs sent for WildFire analysis and is unrelated to ZTNA connectivity. HIP Match log (C) shows host information profile matches for policy enforcement, not authentication or tunnel establishment. Data Filtering log (D) records data pattern matches for DLP-style policies, which is irrelevant to ZTNA tunnel and auth troubleshooting.

Answer

WildFire submission log

Answer

HIP Match log

Answer

Data Filtering log