SSE-Engineer Prisma Access Troubleshooting — 30 Questions

Question 1

An administrator implements a new Decryption policy in Prisma Access to inspect inbound traffic to a public-facing application hosted behind a Prisma Access Public IP. After deployment, users report receiving certificate warning errors. What should the administrator inspect first to resolve the warning?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the correct server certificate and private key are imported into Panorama and bound to the Inbound Decryption rule.. Inbound SSL decryption requires the specific server certificate and private key to be imported into Panorama and referenced in the Decryption policy.

Answer

Check whether the GlobalProtect client version on the user's laptop is up to date.

Answer

Ensure that WildFire analysis is disabled for inbound decrypted traffic.

Answer

Verify the OCSP responder settings under Device > Setup > Sessions.

Question 2

A Prisma Access engineer is troubleshooting an issue where users in a specific Remote Network location cannot authenticate against an on-premises LDAP server because the Service Connection is dropping packets. What is the recommended Panorama CLI command to test connectivity to the LDAP server through the Service Connection?

Accepted Answer

Execute 'ping source host ' from the specific Prisma Access node or use operational commands via Panorama.. The test command 'test aaa-server login' or ping utilities executed from the appropriate Prisma Access node CLI help diagnose connectivity and authentication issues.

Answer

Run 'show system resources' to check CPU utilization of the Panorama VM.

Answer

SSH to the Prisma Access node or use the Panorama CLI to run 'test security-policy-match' for the LDAP traffic.

Answer

Use the CLI command 'ping source

' from the Panorama management plane.

Question 3

A security administrator needs to check real-time threat logs for a specific Prisma Access mobile user who reports being blocked from accessing a malicious file. Which Panorama menu path provides the most direct access to these logs?

Accepted Answer

Monitor > Logs > Threat.. Threat logs in Prisma Access are viewed centrally in Panorama under Monitor > Logs > Threat.

Answer

Panorama > Cloud Services > Setup > Management.

Answer

Prisma Access > Service Setup > Locations.

Answer

Policies > Security.

Question 4

An organization uses SAML authentication with Prisma Access for mobile users. Users report an intermittent 'Authentication Failed' error when trying to establish a GlobalProtect connection. The Identity Provider (IdP) logs show successful authentication, but Prisma Access logs indicate a failure. What is the most likely cause of this discrepancy?

Accepted Answer

Clock skew between the SAML Identity Provider and the Prisma Access service nodes exceeding the allowed tolerance window.. SAML assertion validation failures often occur due to clock skew between the IdP and the Prisma Access authentication profile settings.

Answer

The GlobalProtect client software license has expired on Panorama.

Answer

The User-ID agent service on the Panorama management server is stopped.

Answer

WildFire cloud subscription has lapsed.

Question 5

An administrator notices that a subset of mobile users connecting via GlobalProtect in Prisma Access cannot resolve internal corporate hostnames, while external websites load normally. The split-tunnel configuration includes the corporate domain. Where should the administrator check first in Panorama to troubleshoot this DNS resolution failure?

Accepted Answer

Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config > DNS and-or WINS.. In Prisma Access, DNS server assignments for mobile users are pushed via the GlobalProtect Agent configuration under Network > GlobalProtect > Client Settings.

Answer

Panorama > Prisma Access > Monitoring > ACC.

Answer

Panorama > Cloud Services > Status > Traffic Log.

Answer

Panorama > Firewall > Network Profiles > Interface.

Question 6

A network engineer is configuring Prisma Access and needs to verify the status of deployed Mobile User nodes across different regions. Which Panorama workspace is dedicated to displaying the overall health and status of Prisma Access infrastructure?

Accepted Answer

Panorama > Cloud Services > Status.. Panorama > Cloud Services > Status provides a comprehensive dashboard for Prisma Access infrastructure health.

Answer

Objects > Certificates.

Answer

Policies > QoS.

Answer

Monitor > Managed Devices.

Question 7

A remote network user in a Prisma Access deployment is experiencing intermittent packet loss and slow application performance over the IPsec tunnel to the Remote Network (RN) node. Upon checking the system logs, the network engineer notices repetitive IKE rekey negotiations. Which troubleshooting step should be taken first to identify the root cause?

Accepted Answer

Verify that Dead Peer Detection (DPD) intervals match between the CPE device and Prisma Access node, and check tunnel monitoring statistics.. Checking the IPsec and IKE tunnel status via the Prisma Access CLI or Panorama status monitor helps identify cryptographic mismatch or dead peer detection (DPD) timeouts causing flapping.

Answer

Disable SSL decryption on the Security Predefined Policy.

Answer

Change the mobile user portal authentication profile.

Answer

Restart the GlobalProtect service on the remote user's endpoint.

Question 8

While troubleshooting a Prisma Access Remote Network deployment, an engineer notices that routes advertised via BGP from the customer's data center are not appearing in the Prisma Access routing table. Where can the engineer view BGP peer status and learned routes in Panorama?

Accepted Answer

Prisma Access > Service Setup > Routing > BGP Status, or by viewing runtime stats via the Prisma Access monitoring dashboard in Panorama.. BGP routing status can be monitored via Runtime Stats in the Prisma Access monitoring tools or CLI.

Answer

Panorama > Cloud Services > Status > BGP Peers.

Answer

Monitor > Dynamic Updates > BGP.

Answer

Policies > NAT.

Question 9

An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?

Accepted Answer

Inspect the custom application definitions and ensure Custom App-IDs are mapped to the correct non-standard ports, and that security rules permit those ports.. App-ID inspects traffic dynamically, but if custom ports are used, Custom App-IDs or Service objects must be correctly configured in security policies.

Answer

Configure a static NAT rule for the non-standard ports on the service connection.

Answer

Disable GlobalProtect pre-logon mode.

Answer

Enable SSL Forward Proxy on the destination zones.

Question 10

An administrator is troubleshooting a Prisma Access mobile user environment where users are unable to connect because of an invalid certificate error presented by the GlobalProtect Portal. Which configuration element in Panorama should be verified?

Accepted Answer

Verify that the SSL/TLS certificate assigned to the GlobalProtect Portal configuration is valid, not expired, and trusted by the client devices.. The GlobalProtect Portal SSL/TLS certificate configuration is tied to the portal configuration profile.

Answer

Check the IPsec crypto profile under Network > Network Profiles > IPsec Crypto.

Answer

Check the User-ID agent connection timeout settings.

Answer

Verify the BGP AS number on the Remote Network node.

Question 11

An administrator needs to monitor the volume of traffic passing through a specific Prisma Access Service Connection. Which monitoring tool in Panorama displays aggregated data on bandwidth usage, top applications, and top users?

Accepted Answer

Monitor > ACC (Application Command Center).. The Application Command Center (ACC) in Panorama provides visual summaries of traffic trends, bandwidth usage, top applications, and users.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Device > Log Settings.

Answer

Policies > QoS.

Question 12

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

Accepted Answer

Panorama > Cloud Services > Setup > Support.. TSFs for Prisma Access can be generated under Panorama > Cloud Services > Setup > Support.

Answer

Device > Support > Tech Support File.

Answer

Monitor > Logs > System.

Answer

Policies > Security.

Question 13

A security team reports that threat prevention signatures are not updating on Prisma Access nodes. Where in Panorama should the administrator verify the scheduling and status of dynamic updates for Prisma Access?

Accepted Answer

Panorama > Device Deployment > Dynamic Updates.. Dynamic updates for Prisma Access are managed via Panorama under Panorama > Device Deployment > Dynamic Updates or Cloud Services dynamic update schedules.

Answer

Panorama > Cloud Services > Setup > Dynamic Updates.

Answer

Prisma Access > Service Setup > Threat Prevention.

Answer

Monitor > Dynamic Updates > Status.

Question 14

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

Accepted Answer

Use the CLI operational command 'show user ip-user-mapping all' or check User-ID status in the Prisma Access monitoring dashboard.. Panorama operational commands or the User-ID status monitoring tool show active user-to-IP mappings.

Answer

Check the GlobalProtect Gateway tunnel status.

Answer

Run 'show system software status'.

Answer

Verify the SSL Decryption certificate expiration date.

Question 15

An enterprise deployment of Prisma Access uses explicit proxy. Users report that specific SaaS applications are failing because the proxy is stripping required HTTP headers. Where should the administrator check and modify proxy header insertion rules in Prisma Access?

Accepted Answer

Panorama > Cloud Services > Service Setup > Proxy Settings / Decryption Profiles.. HTTP header insertion and modification rules are configured in decryption or proxy profiles within Prisma Access.

Answer

Objects > Custom Objects > URL Filtering.

Answer

Network > GlobalProtect > Gateways > Agent > Client Settings.

Answer

Policies > NAT.

Question 16

A remote network connected via Prisma Access is experiencing packet drops due to Maximum Transmission Unit (MTU) size mismatches. Which troubleshooting technique or configuration should be verified to resolve IP packet fragmentation issues?

Accepted Answer

Enable TCP MSS clamping on the IPsec tunnel settings or ensure the local CPE device correctly handles ICMP Destination Unreachable messages.. Path MTU Discovery and MSS clamping configurations on the IPsec tunnel help prevent packet fragmentation issues across Prisma Access tunnels.

Answer

Change the mobile user authentication type from SAML to RADIUS.

Answer

Configure a WildFire analysis profile to bypass large files.

Answer

Increase the GlobalProtect client idle timeout value to 3600 seconds.

Question 17

An administrator needs to review configuration changes made to Prisma Access settings in Panorama over the past week to determine who modified a security policy. Which log should the administrator examine?

Accepted Answer

Monitor > Logs > Config.. Configuration logs record all changes made to configurations in Panorama.

Answer

Monitor > Logs > Threat.

Answer

Monitor > Logs > Data Filtering.

Answer

Monitor > Logs > Traffic.

Question 18

A Prisma Access deployment utilizes Service Connections to connect to a corporate data center. An administrator notices that traffic destined for internal data center subnets is being sent out to the internet instead of the Service Connection. What is the most likely cause of this routing misconfiguration?

Accepted Answer

Missing or incorrect static routes / BGP route advertisements for the internal subnets in the Service Connection routing configuration.. Incorrect static or dynamic routing advertisements (such as missing or overlapping static routes / BGP prefixes) cause traffic to take the default internet route instead of the Service Connection.

Answer

WildFire inspection is enabled on the security policy rule.

Answer

The Security Predefined Policy rule order is incorrect.

Answer

The GlobalProtect Portal client timeout is set too low.

Question 19

An administrator troubleshooting a Prisma Access mobile user connectivity issue wants to verify whether the GlobalProtect gateway is actively responding to client connection requests. Where can this real-time session and gateway status be verified?

Accepted Answer

Panorama > Cloud Services > Status > Mobile Users > Gateways.. Gateway status and active sessions can be checked in Panorama under Cloud Services > Status or via operational CLI commands.

Answer

Policies > Decryption.

Answer

Device > Setup > Operations.

Answer

Objects > Addresses.

Question 20

When troubleshooting a Prisma Access deployment using SAML authentication, an administrator notices that users are successfully authenticated by the IdP, but the GlobalProtect client displays an error stating 'Invalid SAML Response: Signature Validation Failed'. What is the most likely root cause?

Accepted Answer

The IdP signing certificate imported into the Prisma Access authentication profile does not match the active certificate currently used by the IdP.. Signature validation failure indicates a mismatch or expiration of the IdP signing certificate configured in the Prisma Access SAML Identity Provider profile.

Answer

The decryption policy is blocking HTTPS traffic to the IdP.

Answer

The User-ID agent service on Panorama has crashed.

Answer

The GlobalProtect client version is outdated and does not support SAML.