SSE-Engineer Prisma Access Services Practice Test 5 — 15 Questions

Question 1

A security architect is designing a Prisma Access FWaaS deployment and needs to ensure robust security posture across all zones (Mobile Users, Remote Networks, Service Connections, and Internet). Which THREE security profile types should be attached to Security Policy rules to ensure comprehensive threat prevention? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vulnerability Protection Security Profile. Option B (Vulnerability Protection Security Profile) is correct because it inspects traffic for exploits targeting known CVEs and blocks them, which is essential for threat prevention across all Prisma Access zones. Option C (Antivirus Security Profile) is correct because it scans for and blocks malware, viruses, and spyware in allowed traffic, providing the core content-based threat prevention needed in every zone. Option E (WildFire Analysis Security Profile) is correct because it forwards suspicious files and links to WildFire for cloud-based sandbox analysis and inline ML verdicts, delivering zero-day protection that complements antivirus and vulnerability profiles. Option A (GlobalProtect Portal Configuration Profile) is not a security profile attached to Security Policy rules; it configures the GlobalProtect portal for endpoint connectivity, not threat inspection. Option D (Cloud Services Dynamic Template) is not a security profile either; it is a Prisma Access configuration construct used to push settings to cloud-managed firewalls, not a rule-attached threat prevention profile.

Answer

GlobalProtect Portal Configuration Profile

Answer

Cloud Services Dynamic Template

Question 2

An administrator is configuring Prisma Access Secure Web Gateway and wants to restrict access to high-risk web categories. Which TWO options represent configurable actions within a Prisma Access URL Filtering profile? (Choose two)

Accepted Answer

Continue. In a Prisma Access URL Filtering profile, each URL category can be assigned an action, and the two configurable actions listed here are Continue (B) and Block (D). Continue (B) allows the request to proceed to the site, which is the standard action for categories deemed acceptable or low risk. Block (D) denies the request and typically serves a block response page, which is exactly what an administrator would use to restrict access to high-risk web categories. Decrypt (A) is not a URL Filtering profile action; decryption is handled by a Decryption policy/profile. Sandbox (C) is not a URL Filtering action either; it is configured through a WildFire Analysis profile or file-blocking settings. Quarantine (E) is not a URL Filtering action; quarantine is associated with threat prevention or file quarantine, not URL category enforcement.

Answer

Decrypt

Answer

Sandbox

Answer

Quarantine

Question 3

An administrator needs to configure Prisma Access ZTNA to verify endpoint hygiene before granting access to internal applications. Which TWO posture checks can be evaluated using GlobalProtect Host Information Profiles (HIP)? (Choose two)

Accepted Answer

Antivirus presence and definition update status. Option C is correct because GlobalProtect Host Information Profiles (HIP) include the Anti-Malware object, which collects whether antivirus/anti-malware software is installed, running, real-time protection is enabled, and whether definitions are current (via the 'Anti-Malware' check with definition date/version thresholds). Option E is correct because HIP includes the Disk Backup and Disk Encryption objects, which report whether full-disk encryption such as BitLocker (Windows) or FileVault (macOS) is enabled on the endpoint. Option A is not a HIP posture check; AD group membership is evaluated through User-ID/group mapping in policy, not endpoint HIP data. Option B is irrelevant to endpoint posture, as BGP route metrics are a routing protocol attribute handled by the virtual router, not by GlobalProtect HIP. Option D is also not a HIP check; SAML IdP MFA token validity is an authentication/SSO concern handled by the identity provider and authentication profile, not by endpoint host information.

Answer

Active Directory group membership hierarchy

Answer

BGP route advertisement metrics

Answer

SAML Identity Provider multi-factor authentication token validity

Question 4

An administrator is configuring Prisma Access SWG and needs to implement granular control over file sharing and collaboration tools. Which TWO SaaS Security features can be configured in Prisma Access to achieve this? (Choose two)

Accepted Answer

Shadow IT discovery and risk scoring of unapproved cloud applications. Option B is correct because Prisma Access SaaS Security includes Shadow IT discovery, which uses traffic telemetry to identify unsanctioned cloud applications and assigns each a risk score so administrators can decide whether to block, allow, or coach users. Option D is correct because SaaS application activity controls provide granular, per-application policy enforcement—for example, allowing access to a collaboration tool while blocking actions such as external file sharing, public link creation, or uploads to personal accounts. Together these features deliver the visibility and action-level control the administrator needs over file sharing and collaboration SaaS. Option A is incorrect because IPsec crypto profiles govern VPN tunnel encryption parameters for branch connectivity, not SaaS application control. Option C is incorrect because GlobalProtect client version deployment rules manage endpoint agent software versions, not SaaS usage policies. Option E is incorrect because WMI-based user mapping polling relates to User-ID agent configuration for mapping users to IP addresses, not SaaS Security enforcement.

Answer

IPsec crypto profile selection for branch offices

Answer

GlobalProtect client software version deployment rules

Answer

WMI-based user mapping polling intervals

Question 5

An enterprise is planning a Prisma Access deployment and wants to optimize performance and redundancy for Remote Networks. Which THREE best practices should the network architect follow when designing IPsec connections to Prisma Access? (Choose three)

Accepted Answer

Configure redundant IPsec tunnels from separate CPE devices or diverse ISP connections to Prisma Access.. Option B is correct because Prisma Access remote network best practices call for redundant IPsec tunnels terminating from separate CPE devices or diverse ISP links, so a single device or circuit failure does not take down the branch. Option C is correct because IPsec encapsulation adds overhead, and configuring TCP MSS clamping on the CPE routers prevents large packets from being fragmented or dropped across the tunnel. Option E is correct because running BGP over the IPsec tunnels enables dynamic route exchange and automated failover between primary and secondary tunnels without manual intervention. Option A is incorrect because DPD should be enabled, not disabled, so that failed peers are detected and tunnels can fail over quickly. Option D is incorrect because forcing OSPF area 0 across all tunnels is not a Prisma Access best practice and does not provide the automated failover that BGP does.

Answer

Disable Dead Peer Detection (DPD) to keep tunnels permanently active.

Answer

Use OSPF area 0 across all IPsec tunnels to establish fast convergence.

Question 6

An administrator wants to ensure high availability and resilient connectivity for mobile users connecting to Prisma Access. Which TWO features or mechanisms are utilized by Prisma Access to ensure reliable mobile user access? (Choose two)

Accepted Answer

Cloud-scale redundant gateway architecture across multiple geographic locations. Option B is correct because Prisma Access is built on a cloud-scale, multi-tenant infrastructure with redundant gateways distributed across many geographic locations, so mobile users can always reach a healthy service node even if one region or gateway fails. Option E is correct because GlobalProtect clients use automatic gateway selection, where the client is directed to the best-performing regional service node based on latency and availability, providing resilient and optimized connectivity without manual intervention. Option A is incorrect because static routing tables and OS registry settings are not how Prisma Access delivers high availability; routing is handled dynamically in the cloud. Option C is incorrect because failover is automatic within Prisma Access, not driven by manual IPsec failover scripts on each endpoint. Option D is incorrect because Prisma Access is a cloud-delivered service and does not rely on on-premise physical hardware load balancers in front of mobile user tunnels.

Answer

Static routing tables configured locally on Windows and macOS registry settings

Answer

Manual IPsec tunnel failover scripting executed on each endpoint device

Answer

On-premise physical hardware load balancers deployed in front of mobile user tunnels

Question 7

An administrator is configuring authentication for Prisma Access mobile users. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

Accepted Answer

RADIUS and LDAP authentication servers. Option B is correct because Prisma Access GlobalProtect natively supports RADIUS and LDAP authentication servers, allowing the mobile user gateway/portal to forward credentials to an external RADIUS or LDAP directory for validation. Option E is correct because Prisma Access also natively integrates with SAML 2.0 Identity Providers such as Okta, Microsoft Entra ID, and Ping Identity, enabling browser-based single sign-on for GlobalProtect mobile users. Options A, C, and D are not valid native authentication methods: local plaintext password files on endpoints are insecure and not a supported Prisma Access authentication mechanism, peer-to-peer certificate exchange without a trusted certificate authority does not provide proper identity validation, and hardcoded pre-shared keys without user credentials do not authenticate individual mobile users.

Answer

Local plaintext password files stored on user endpoint hard drives

Answer

Peer-to-peer certificate exchange without an authentication authority

Answer

Hardcoded pre-shared keys without user credentials

Question 8

An enterprise is deploying Prisma Access Service Connections to connect corporate data centers to the cloud security platform. Which THREE configuration parameters must be correctly specified on Panorama for a Service Connection? (Choose three)

Accepted Answer

BGP peer AS number and peering IP addresses for dynamic route exchange.. Option B is correct because a Prisma Access Service Connection uses BGP to exchange routes between the corporate data center and the Prisma Access infrastructure, so the BGP peer AS number and peering IP addresses must be configured on Panorama. Option D is correct because the Service Connection is an IPsec tunnel, requiring both an IKE Crypto Profile (for Phase 1) and an IPsec Crypto Profile (for Phase 2) to define encryption, authentication, and lifetime parameters. Option E is correct because Panorama must know the public peer IP address of the enterprise data center VPN gateway to establish the IPsec tunnel termination. Option A is incorrect because GlobalProtect client software download URLs are configured for mobile user/remote access deployments, not for Service Connections. Option C is incorrect because WMI probing schedules are used for User-ID and Active Directory domain discovery, which is unrelated to Service Connection tunnel configuration.

Answer

GlobalProtect client software download URLs for mobile endpoints.

Answer

WMI probing schedules for Active Directory domain discovery.

Question 9

A deployment of Prisma Access requires ZTNA 2.0 posture check enforcement for remote users. The administrator must ensure that mobile devices attempting to connect to internal corporate apps are evaluated for disk encryption and active endpoint protection agents prior to tunnel establishment. Which component performs this real-time device posture assessment?

Accepted Answer

GlobalProtect app using Host Information Profile (HIP) reporting. The GlobalProtect app collects endpoint posture data via Host Information Profile (HIP) and sends it to the Prisma Access gateway before tunnel establishment. This real-time assessment checks disk encryption and endpoint protection agents, enabling ZTNA 2.0 policy enforcement. The HIP data is evaluated against HIP profiles to determine access, ensuring only compliant devices connect.

Answer

Remote Networks (RN) node

Answer

Cloud Secure Web Gateway (SWG) explicit proxy listener

Answer

Cloud Managed Services (CMS) collector

Question 10

An organization is migrating their branch offices to Prisma Access Firewall as a Service (FWaaS). What is the primary method used to connect a physical branch office location to the Prisma Access cloud infrastructure securely?

Accepted Answer

IPsec VPN tunnels from the branch office router or firewall to Prisma Access Remote Networks. Prisma Access Remote Networks are designed to connect physical branch offices to the Prisma Access cloud infrastructure using IPsec VPN tunnels terminated on the branch's CPE router or firewall. The CPE establishes an IKE/IPsec tunnel to Prisma Access service IP addresses, which are provided during Remote Network onboarding in Panorama. This is the standard, supported method for branch connectivity and does not require client software on individual endpoints.

Answer

Direct peering via AWS Direct Connect without any encapsulation

Answer

GlobalProtect client software installed on every desktop in the branch

Answer

Explicit HTTP proxy configuration pushed via browser group policy

Question 11

A Prisma Access administrator needs to implement ZTNA 2.0 continuous trust verification for mobile users accessing internal private applications. Which feature ensures that continuous validation of both user identity and device posture occurs throughout the session, rather than only at initial authentication?

Accepted Answer

Continuous Trust Verification via periodic Host Information Profile (HIP) re-evaluation and app-connector telemetry. ZTNA 2.0 in Prisma Access enforces continuous trust verification by re-evaluating device posture (HIP checks) and user context periodically during active sessions, cutting off access if conditions change.

Answer

Pre-logon GlobalProtect connection mode

Answer

Explicit proxy PAC file auto-discovery

Answer

RADIUS single sign-on (SSO) integration with Multi-Factor Authentication

Question 12

When configuring Prisma Access for ZTNA 2.0 to control access to private applications, which TWO components or configurations are mandatory for establishing least-privileged application access? (Choose two)

Accepted Answer

App-ID based security policies that explicitly name specific internal applications rather than subnets. Option D is correct because ZTNA 2.0 in Prisma Access enforces least-privileged access through App-ID based security policies that identify specific internal applications (e.g., 'web-app-finance' or 'ssh-server-01') instead of broad subnet ranges, so only the intended application is reachable. Option E is correct because App Connectors are the mandatory component deployed inside the internal network that host the private applications; they establish outbound-initiated tunnels to Prisma Access and publish those apps to the service, enabling per-app access without exposing the network. The other options are not required: PPTP is a deprecated, insecure legacy VPN protocol and is not part of ZTNA 2.0 (A); PAC files are a proxy auto-configuration mechanism for web traffic, not a ZTNA private-app access requirement (B); and assigning public IP addresses to every internal workstation is unnecessary and contrary to ZTNA principles, since App Connectors and the Prisma Access infrastructure handle connectivity without exposing endpoints (C).

Answer

Legacy PPTP VPN dial-in server integration

Answer

Explicit PAC files distributed to all internal users

Answer

Public IP addresses assigned to every internal workstation

Question 13

An administrator is configuring Prisma Access Firewall as a Service (FWaaS) to protect outbound internet traffic from remote networks. They want to ensure that known command-and-control (C2) traffic and vulnerability exploits are blocked dynamically in real time. Which security profile should be applied to the security policy rules?

Accepted Answer

Anti-Spyware and Vulnerability Protection profiles. Anti-Spyware profiles detect and block command-and-control (C2) traffic, spyware, and known malicious callbacks, while Vulnerability Protection profiles block exploits targeting software vulnerabilities. Applying both to the security policy rule provides real-time dynamic blocking of C2 and exploit traffic.

Answer

URL Filtering and Decryption profiles only

Answer

Data Filtering and File Blocking profiles only

Answer

User-ID and Device-ID mapping policies

Question 14

An administrator is designing a Prisma Access Secure Web Gateway (SWG) and CASB architecture. Which THREE capabilities can be enforced natively through Prisma Access SWG and inline CASB policies? (Choose three)

Accepted Answer

Granular action control such as allowing read-only access while blocking file uploads to sanctioned or unsanctioned SaaS tenants. Option A is correct because Prisma Access inline CASB provides granular SaaS action control, distinguishing activities like view/read versus upload/edit, and can apply these controls to both sanctioned and unsanctioned SaaS tenants discovered via Shadow IT. Option C is correct because Prisma Access SWG natively enforces URL filtering using URL categories, including web categories and threat/risk categories, to allow or block web traffic. Option E is correct because Prisma Access Data Filtering (DLP) inspects traffic inline to detect and block exfiltration of sensitive data patterns such as credit card numbers and PII. Option B is not correct because Prisma Access does not establish direct peer-to-peer BGP sessions with external public web servers; BGP is used for service infrastructure routing, not client-to-webserver peering. Option D is not correct because BIOS firmware flashing and motherboard diagnostics are endpoint hardware management functions, not capabilities of an SWG or inline CASB security policy.

Answer

Direct peer-to-peer BGP routing exchanges with external public web servers

Answer

Local BIOS firmware flashing and motherboard diagnostics for remote client laptops

Question 15

An administrator is troubleshooting a connectivity issue where remote mobile users cannot reach internal private applications via Prisma Access ZTNA. Which THREE diagnostic steps or verification checks should the administrator perform? (Choose three)

Accepted Answer

Verify that the GlobalProtect app on the user endpoint has successfully established a secure tunnel and updated its Host Information Profile (HIP). Option A is correct because Prisma Access ZTNA relies on the GlobalProtect app to establish the secure tunnel and report an up-to-date Host Information Profile (HIP); if the tunnel is down or HIP data is stale, the endpoint cannot be matched to the correct ZTNA policy and internal apps become unreachable. Option B is correct because the App Connectors are the components that publish and proxy internal private applications to Prisma Access; if they are disconnected or unhealthy in the management plane, mobile users have no path to those applications. Option D is correct because the Traffic and Threat logs show whether security policy, ZTNA rules, or threat inspection are allowing or dropping the application traffic, which is essential to pinpoint a policy-related block. Option C is incorrect because rebooting a public cloud hypervisor hosting the tenant is a disruptive, unsupported action that does not address ZTNA tunnel, connector, or policy causes. Option E is incorrect because changing the local ISP router's BGP autonomous system number is unrelated to Prisma Access ZTNA and would not fix endpoint-to-app connectivity.

Answer

Reboot the physical public cloud provider datacenter hypervisor hosting the tenant

Answer

Reconfigure the local ISP router's BGP autonomous system number to match the Prisma Access gateway