SSE-Engineer Prisma Access Troubleshooting — 25 Questions

Question 1

A Prisma Access engineer is troubleshooting an issue where users in a specific Remote Network location cannot authenticate against an on-premises LDAP server because the Service Connection is dropping packets. What is the recommended Panorama CLI command to test connectivity to the LDAP server through the Service Connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Execute 'ping source host ' from the specific Prisma Access node or use operational commands via Panorama.. The recommended approach is to execute 'ping source host ' from the specific Prisma Access node or use operational commands via Panorama (A). This tests connectivity from the dataplane interface that handles Service Connection traffic, which is the correct source for traffic destined to the on-premises LDAP server. Using the dataplane interface ensures the test simulates actual traffic flow through the Service Connection.

Answer

Run 'show system resources' to check CPU utilization of the Panorama VM.

Answer

SSH to the Prisma Access node or use the Panorama CLI to run 'test security-policy-match' for the LDAP traffic.

Answer

Use the CLI command 'ping source

' from the Panorama management plane.

Question 2

A remote network user in a Prisma Access deployment is experiencing intermittent packet loss and slow application performance over the IPsec tunnel to the Remote Network (RN) node. Upon checking the system logs, the network engineer notices repetitive IKE rekey negotiations. Which troubleshooting step should be taken first to identify the root cause?

Accepted Answer

Verify that Dead Peer Detection (DPD) intervals match between the CPE device and Prisma Access node, and check tunnel monitoring statistics.. Checking the IPsec and IKE tunnel status via the Prisma Access CLI or Panorama status monitor helps identify cryptographic mismatch or dead peer detection (DPD) timeouts causing flapping.

Answer

Disable SSL decryption on the Security Predefined Policy.

Answer

Change the mobile user portal authentication profile.

Answer

Restart the GlobalProtect service on the remote user's endpoint.

Question 3

While troubleshooting a Prisma Access Remote Network deployment, an engineer notices that routes advertised via BGP from the customer's data center are not appearing in the Prisma Access routing table. Where can the engineer view BGP peer status and learned routes in Panorama?

Accepted Answer

Prisma Access > Service Setup > Routing > BGP Status, or by viewing runtime stats via the Prisma Access monitoring dashboard in Panorama.. In Prisma Access, BGP peer status and learned routes for Remote Network connections are viewed under Prisma Access > Service Setup > Routing > BGP Status, or through the Prisma Access monitoring dashboard's runtime statistics. This is the dedicated location where Panorama surfaces the dynamic routing state for the managed Prisma Access infrastructure, including peer adjacency and received prefixes. The other options point to unrelated Panorama menus that do not expose BGP operational data for Prisma Access.

Answer

Panorama > Cloud Services > Status > BGP Peers.

Answer

Monitor > Dynamic Updates > BGP.

Answer

Policies > NAT.

Question 4

A security team reports that threat prevention signatures are not updating on Prisma Access nodes. Where in Panorama should the administrator verify the scheduling and status of dynamic updates for Prisma Access?

Accepted Answer

Panorama > Device Deployment > Dynamic Updates.. Dynamic update scheduling and status for Prisma Access are managed from Panorama under Device Deployment > Dynamic Updates, where the administrator can view the current content versions, schedule recurring updates, and push them to the Prisma Access infrastructure. This is the centralized location for managing antivirus, WildFire, and threat prevention content across managed firewalls and cloud service nodes.

Answer

Panorama > Cloud Services > Setup > Dynamic Updates.

Answer

Prisma Access > Service Setup > Threat Prevention.

Answer

Monitor > Dynamic Updates > Status.

Question 5

An enterprise deployment of Prisma Access uses explicit proxy. Users report that specific SaaS applications are failing because the proxy is stripping required HTTP headers. Where should the administrator check and modify proxy header insertion rules in Prisma Access?

Accepted Answer

Panorama > Cloud Services > Service Setup > Proxy Settings / Decryption Profiles.. The correct location is Panorama > Cloud Services > Service Setup > Proxy Settings / Decryption Profiles (A). In Prisma Access explicit proxy deployments, header insertion rules are configured within the proxy settings, often under decryption profiles or proxy configurations. This is where administrators can define which HTTP headers to insert, modify, or strip for specific applications or destinations.

Answer

Objects > Custom Objects > URL Filtering.

Answer

Network > GlobalProtect > Gateways > Agent > Client Settings.

Answer

Policies > NAT.

Question 6

An organization notices that certain cloud-based SaaS applications are experiencing performance bottlenecks when accessed through Prisma Access mobile users. The administrator wants to configure explicit SaaS application traffic steering or bypass. Where is this configured in Panorama for Prisma Access?

Accepted Answer

Panorama > Cloud Services > Prisma Access > Mobile Users > Traffic Steering / QoS or GlobalProtect Client Settings.. Explicit SaaS application traffic steering or bypass for Prisma Access mobile users is configured under Panorama > Cloud Services > Prisma Access > Mobile Users > Traffic Steering / QoS or GlobalProtect Client Settings. This location allows administrators to define traffic steering rules that identify SaaS applications (via App-ID or custom URL categories) and specify whether to forward, bypass, or apply QoS. It is the centralized policy point for mobile user traffic handling in Prisma Access.

Answer

Device > Setup > Content ID.

Answer

Policies > Decryption.

Answer

Objects > Custom Objects > URL Filtering.

Question 7

When troubleshooting SSL Decryption issues in a Prisma Access environment where users report certificate warnings, which THREE areas should an administrator inspect? (Choose three)

Accepted Answer

Check the Decryption Policy rules to ensure the correct traffic zones, URLs, and actions (Decrypt/No Decrypt) are configured.. Option A is correct because decryption behavior is driven by the Decryption Policy: the administrator must confirm that the correct source/destination zones, URL categories or FQDN matches, and the Decrypt/No Decrypt action are applied so intended traffic is actually decrypted rather than bypassed. Option C is correct because for Inbound (SSL Forward Proxy server-side) decryption, the rule's server certificate and private key must be correctly bound; a missing, expired, or mismatched certificate/key pair will cause handshake failures and certificate warnings. Option E is correct because Prisma Access uses Forward Trust and Forward Untrust certificates to sign re-encrypted (proxied) sessions, and if these are not issued by the organization's Enterprise CA and trusted by the endpoints, browsers will present untrusted-certificate warnings. Option B is not relevant because BGP routing for Service Connection prefixes affects reachability and path selection, not certificate trust or decryption policy evaluation. Option D is not relevant because the GlobalProtect client version on mobile workstations does not determine whether decrypted sessions present a trusted certificate; certificate warnings stem from decryption policy, certificate binding, or trust chain issues.

Answer

Verify the BGP routing table for Service Connection prefixes.

Answer

Check the GlobalProtect client version installed on mobile workstations.

Question 8

Which TWO methods can an administrator use to monitor the health and operational status of Prisma Access Service Connections in Panorama? (Choose two)

Accepted Answer

Panorama > Cloud Services > Status > Service Connections dashboard.. Option A is correct because Panorama provides a dedicated Cloud Services > Status > Service Connections dashboard that displays the health, status, and tunnel details of each Prisma Access Service Connection, giving administrators a centralized monitoring view. Option E is correct because administrators can also use operational CLI commands and monitoring tools on the service connection to inspect tunnel interface statistics and verify BGP peering or static route status, which are the key indicators of Service Connection health and reachability. The remaining options are incorrect: URL Filtering custom objects (B) are used for web content policy, NAT configuration (C) is for address translation rules, and log forwarding profiles (D) define where logs are sent — none of these monitor Service Connection operational status.

Answer

Objects > Custom Objects > URL Filtering.

Answer

Policies > NAT configuration view.

Answer

Device > Log Settings forwarding profiles.

Question 9

Which TWO commands or tools are recommended for troubleshooting routing issues on Prisma Access infrastructure? (Choose two)

Accepted Answer

CLI operational commands such as 'show routing route' or 'show routing protocol bgp' to inspect active routing tables.. Option B is correct because on Prisma Access infrastructure the CLI operational commands such as 'show routing route' and 'show routing protocol bgp' let you inspect the active routing table and BGP protocol state directly, which is exactly what is needed to diagnose route selection and peering problems. Option C is correct because the Prisma Access monitoring dashboard in Panorama surfaces BGP peer status and traffic paths, giving the recommended GUI-based view of routing health and path selection for the infrastructure. Option A is not appropriate here since Monitor > Logs > Threat shows security threat detections, not routing information. Option D is not appropriate because Device > High Availability state monitor relates to HA peer state, not routing troubleshooting. Option E is not appropriate because Objects > Custom Objects > URL Filtering is for defining URL filtering objects, which has nothing to do with routing diagnostics.

Answer

Monitor > Logs > Threat.

Answer

Device > High Availability state monitor.

Answer

Objects > Custom Objects > URL Filtering.

Question 10

An administrator is troubleshooting a Prisma Access mobile user issue where users connected via GlobalProtect cannot access local network printers or local subnet resources while connected to the VPN. Which THREE settings should be reviewed in Panorama? (Choose three)

Accepted Answer

Check the GlobalProtect Agent configuration regarding 'Access Route' or local network access permissions.. Option B is correct because the GlobalProtect Agent configuration controls whether the agent permits access to local networks; settings such as 'Allow local network access' or the Access Route configuration determine whether traffic to local printers and subnets is allowed or blocked while the tunnel is up. Option C is correct because the Split Tunnel configuration in the GlobalProtect Client Settings defines which destinations are excluded from (or included in) the tunnel; if local subnets are not properly listed in the split-tunnel exclude/include list, local printer and subnet traffic gets routed into the VPN and fails. Option D is correct because the client-side routing table must retain the local subnet gateway routes when the VPN connects; if GlobalProtect installs a default route or removes the local routes, traffic to local resources is sent over the tunnel instead of the local gateway. Option A is not relevant because the BGP AS number on the Service Connection affects routing between Prisma Access and the customer's service connection infrastructure, not a mobile user's access to their own local LAN. Option E is not relevant because WildFire file analysis submission timeout settings concern threat inspection of files and have no bearing on local subnet or printer reachability.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Check the WildFire file analysis submission timeout settings.

Question 11

An enterprise has deployed Prisma Access with multiple remote networks and mobile users. An administrator notices that threat intelligence feeds (such as malicious IP lists and dynamic address groups) are not updating. Which THREE components should be inspected to resolve this update failure? (Choose three)

Accepted Answer

Check External Dynamic List (EDL) URLs and ensure that Prisma Access nodes can successfully reach the external EDL hosting servers.. Option B is correct because External Dynamic Lists (EDLs) are fetched directly by the Prisma Access nodes (via the management plane/service infrastructure), so if the EDL URLs are malformed or the hosting servers are unreachable due to DNS, proxy, or firewall restrictions, the malicious IP lists and dynamic address groups will never refresh. Option C is correct because Panorama must have outbound internet access to reach Palo Alto Networks update servers (updates.paloaltonetworks.com) to download threat feeds, Applications and Threats content, and other dynamic updates that are then pushed to Prisma Access. Option D is correct because the Dynamic Update schedule under Device > Dynamic Updates (and its deployment status under Device Deployment) determines whether content and threat-feed updates are actually scheduled, downloaded, and applied to managed firewalls; a disabled or failed schedule directly explains stale feeds. Option A is not relevant because the BGP ASN on the Service Connection only affects routing between Prisma Access and the customer's on-premises/cloud networks, not threat intelligence feed retrieval. Option E is not relevant because the GlobalProtect portal certificate expiration affects user authentication and portal connectivity, not the updating of EDLs or threat feeds.

Answer

Verify the BGP ASN configured on the Service Connection.

Answer

Check the GlobalProtect portal certificate expiration date.

Question 12

An administrator troubleshooting a Prisma Access Mobile Users deployment notices authentication failures for users authenticating via SAML to an external IdP. The users report being stuck in an authentication loop. Which log file on Panorama should the administrator examine to troubleshoot SAML response assertion issues?

Accepted Answer

authd.log. SAML authentication failures and loops in GlobalProtect are typically logged in authd.log on Panorama. This log records authentication events, including SAML assertions and errors, making it the correct place to troubleshoot SAML response assertion issues. Other logs like traffic.log or threat.log do not contain authentication details.

Answer

traffic.log

Answer

globalProtectPortal.log

Answer

threat.log

Question 13

An administrator needs to troubleshoot a Security Policy rule that is expected to block access to unauthorized cloud storage applications in a Prisma Access environment. Where can the administrator view real-time data regarding which specific applications are being utilized by remote users?

Accepted Answer

Panorama > ACC (App-Command Center). The ACC (App-Command Center) provides visual summaries of application usage, threats, and web activity in real time.

Answer

Panorama > Setup > Operations

Answer

Panorama > Managed Devices > Summary

Answer

Prisma Access > Cloud Services > Dashboard > Status

Question 14

An administrator is investigating intermittent authentication failures for remote users connecting via GlobalProtect to Prisma Access using SAML. Which THREE log sources or troubleshooting commands can assist in identifying the root cause? (Choose three)

Accepted Answer

authd.log on Panorama/Prisma Access. Option A, authd.log on Panorama/Prisma Access, is correct because authentication daemon (authd) logging records the SAML/authentication processing on the management plane, including the exchange with the IdP and any failures in the auth sequence, which is exactly where intermittent SAML authentication errors surface. Option C, GlobalProtect app debug logs on the client endpoint, is correct because the endpoint's PanGPS debug logs capture the client-side SAML flow, including browser/embedded-browser interactions, cookie handling, and the exact point where authentication stalls or fails. Option D, globalProtectPortal.log, is correct because it records portal-level events such as configuration retrieval, client authentication, and portal-side SAML handling, helping correlate whether the failure occurs at the portal stage. Option B, a data-plane packet capture of HTTP/2 server streams, is not the right tool here because SAML authentication is handled on the management plane rather than the data plane, so a data-plane pcap would not capture the relevant authentication exchange. Option E, the Panorama ACC threat widget counters, is unrelated because ACC threat counters reflect security policy and threat detection statistics, not authentication troubleshooting.

Answer

Data-plane packet capture (pcap) of HTTP/2 server streams

Answer

Panorama ACC threat widget counters

Question 15

A Prisma Access administrator is troubleshooting a mobile user who cannot access an internal application hosted in a remote network. The user's GlobalProtect connection is established, and other users in the same remote network can access the application. The administrator suspects a routing issue within Prisma Access. Which action should the administrator take to verify the service connection routing for the remote network?

Accepted Answer

Run 'show routing route' on the service connection.. To verify service connection routing for a remote network, the administrator should run 'show routing route' on the service connection. This command reveals the routes that the service connection has learned, including those from remote networks. If the route to the internal application is missing, that explains why the mobile user cannot access it. Other options do not provide the necessary routing details.

Answer

Use the Prisma Access CLI to ping the application from the mobile user's device.

Answer

Review the GlobalProtect logs for the user.

Answer

Check the service connection status in the Prisma Access dashboard.

Question 16

A Prisma Access administrator is troubleshooting a mobile user who reports that DNS resolution for internal domains fails when connected via GlobalProtect. The administrator wants to verify the DNS suffix and search domains pushed to the client. Which tool should the administrator use?

Accepted Answer

GlobalProtect Client Settings in the Prisma Access Portal. The GlobalProtect Client Settings in the Prisma Access Portal are where DNS suffix and search domains are configured for mobile users. To troubleshoot DNS resolution issues, the administrator should verify these settings to ensure they are correctly applied. Other options do not provide the necessary configuration details.

Answer

Prisma Access Dashboard

Answer

GlobalProtect App Logs

Answer

Prisma Access CLI 'show dns-proxy' command

Question 17

A Prisma Access administrator notices that a mobile user's traffic to a sanctioned SaaS application is being blocked by a URL Filtering policy. The administrator wants to quickly verify which URL category the application is being classified under in Prisma Access. Which tool should the administrator use to check the URL category?

Accepted Answer

The URL category lookup tool in the Prisma Access portal. The URL category lookup tool in the Prisma Access portal is designed for on-demand checks of URL categorization. By entering the SaaS application's URL, the administrator can see the assigned category and then verify whether the URL Filtering policy is blocking that category. This is the fastest way to confirm classification and resolve the blocking issue.

Answer

URL Filtering logs in the Prisma Access platform

Answer

GlobalProtect app logs on the user's endpoint

Answer

Threat logs filtered by the application name

Question 18

A Prisma Access engineer is troubleshooting an issue where users in a specific Remote Network location cannot authenticate against an on-premises LDAP server because the Service Connection is dropping packets. What is the recommended Panorama CLI command to test connectivity to the LDAP server through the Service Connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show vpn ipsec-sa tunnel <tunnel-name>. The IPsec tunnel between a branch firewall and Prisma Access consists of Phase 1 (IKE SA) and Phase 2 (IPsec SA). A Phase 2 mismatch, such as differing proxy IDs, prevents traffic flow. The command that specifically displays IPsec SA status and traffic selectors is needed to confirm whether the child SA is established and correctly configured. This allows the engineer to quickly identify and resolve the mismatch.

Answer

show vpn flow name <tunnel-name>

Answer

show vpn ike-sa gateway <gateway-name> detail

Answer

show vpn ike-sa gateway <gateway-name>

Question 19

A Prisma Access administrator configured a Service Connection for a remote network at a new branch office. Branch users can reach internal applications through the tunnel, but DNS queries for the corporate internal domains are being answered by public resolvers instead of the internal DNS servers configured in the Service Connection. The administrator confirms the internal DNS servers are reachable and correctly entered in the Service Connection configuration. Which action should the administrator take to resolve this?

Accepted Answer

Verify that the internal DNS servers are included in the split tunnel / domain list of the Service Connection so corporate domains are forwarded to them.. Internal DNS resolution in Prisma Access depends on the Service Connection knowing which domains belong to the corporate environment. When those domains are listed, queries are sent to the configured internal DNS servers; otherwise the endpoint uses public resolvers and receives wrong or NXDOMAIN answers. Confirming the domain list and split-tunnel inclusion is the correct troubleshooting step.

Answer

Change the GlobalProtect portal agent configuration to force all DNS traffic through the tunnel without regard to destination.

Answer

Add the internal DNS servers to the Remote Network's static route table so the branch routes DNS queries to them directly.

Answer

Enable DNS Security on the Service Connection so that public resolvers are automatically overridden for internal domains.

Question 20

A Prisma Access administrator is troubleshooting a mobile user who experiences slow throughput when accessing the internet through GlobalProtect. The administrator suspects that the traffic is being routed through a suboptimal service connection. Which action should the administrator take to verify the user's traffic path?

Accepted Answer

Use the Prisma Access 'show user ip' command to see the user's assigned IP and associated service connection.. The 'show user ip' command is the correct tool to verify the user's traffic path because it lists the assigned IP and the service connection handling the traffic. This allows the administrator to confirm if the user is routed through a suboptimal service connection. Other options do not provide this specific mapping.

Answer

Run a traceroute from the mobile user's device to the destination.

Answer

Check the GlobalProtect logs for the user's connection details.

Answer

Review the mobile user's HIP profile for network location.