SSE-Engineer Prisma Access Troubleshooting — All Questions With Answers

Question 1

A Prisma Access engineer is troubleshooting an issue where users in a specific Remote Network location cannot authenticate against an on-premises LDAP server because the Service Connection is dropping packets. What is the recommended Panorama CLI command to test connectivity to the LDAP server through the Service Connection?

Accepted Answer

Execute 'ping source host ' from the specific Prisma Access node or use operational commands via Panorama.. The recommended approach is to execute 'ping source host ' from the specific Prisma Access node or use operational commands via Panorama (A). This tests connectivity from the dataplane interface that handles Service Connection traffic, which is the correct source for traffic destined to the on-premises LDAP server. Using the dataplane interface ensures the test simulates actual traffic flow through the Service Connection.

Answer

Run 'show system resources' to check CPU utilization of the Panorama VM.

Answer

SSH to the Prisma Access node or use the Panorama CLI to run 'test security-policy-match' for the LDAP traffic.

Answer

Use the CLI command 'ping source

' from the Panorama management plane.

Question 2

A remote network user in a Prisma Access deployment is experiencing intermittent packet loss and slow application performance over the IPsec tunnel to the Remote Network (RN) node. Upon checking the system logs, the network engineer notices repetitive IKE rekey negotiations. Which troubleshooting step should be taken first to identify the root cause?

Accepted Answer

Verify that Dead Peer Detection (DPD) intervals match between the CPE device and Prisma Access node, and check tunnel monitoring statistics.. Checking the IPsec and IKE tunnel status via the Prisma Access CLI or Panorama status monitor helps identify cryptographic mismatch or dead peer detection (DPD) timeouts causing flapping.

Answer

Disable SSL decryption on the Security Predefined Policy.

Answer

Change the mobile user portal authentication profile.

Answer

Restart the GlobalProtect service on the remote user's endpoint.

Question 3

While troubleshooting a Prisma Access Remote Network deployment, an engineer notices that routes advertised via BGP from the customer's data center are not appearing in the Prisma Access routing table. Where can the engineer view BGP peer status and learned routes in Panorama?

Accepted Answer

Prisma Access > Service Setup > Routing > BGP Status, or by viewing runtime stats via the Prisma Access monitoring dashboard in Panorama.. In Prisma Access, BGP peer status and learned routes for Remote Network connections are viewed under Prisma Access > Service Setup > Routing > BGP Status, or through the Prisma Access monitoring dashboard's runtime statistics. This is the dedicated location where Panorama surfaces the dynamic routing state for the managed Prisma Access infrastructure, including peer adjacency and received prefixes. The other options point to unrelated Panorama menus that do not expose BGP operational data for Prisma Access.

Answer

Panorama > Cloud Services > Status > BGP Peers.

Answer

Monitor > Dynamic Updates > BGP.

Answer

Policies > NAT.

Question 4

A security team reports that threat prevention signatures are not updating on Prisma Access nodes. Where in Panorama should the administrator verify the scheduling and status of dynamic updates for Prisma Access?

Accepted Answer

Panorama > Device Deployment > Dynamic Updates.. Dynamic update scheduling and status for Prisma Access are managed from Panorama under Device Deployment > Dynamic Updates, where the administrator can view the current content versions, schedule recurring updates, and push them to the Prisma Access infrastructure. This is the centralized location for managing antivirus, WildFire, and threat prevention content across managed firewalls and cloud service nodes.

Answer

Panorama > Cloud Services > Setup > Dynamic Updates.

Answer

Prisma Access > Service Setup > Threat Prevention.

Answer

Monitor > Dynamic Updates > Status.

Question 5

An enterprise deployment of Prisma Access uses explicit proxy. Users report that specific SaaS applications are failing because the proxy is stripping required HTTP headers. Where should the administrator check and modify proxy header insertion rules in Prisma Access?

Accepted Answer

Panorama > Cloud Services > Service Setup > Proxy Settings / Decryption Profiles.. The correct location is Panorama > Cloud Services > Service Setup > Proxy Settings / Decryption Profiles (A). In Prisma Access explicit proxy deployments, header insertion rules are configured within the proxy settings, often under decryption profiles or proxy configurations. This is where administrators can define which HTTP headers to insert, modify, or strip for specific applications or destinations.

Answer

Objects > Custom Objects > URL Filtering.

Answer

Network > GlobalProtect > Gateways > Agent > Client Settings.

Answer

Policies > NAT.

Question 6

An organization notices that certain cloud-based SaaS applications are experiencing performance bottlenecks when accessed through Prisma Access mobile users. The administrator wants to configure explicit SaaS application traffic steering or bypass. Where is this configured in Panorama for Prisma Access?

Accepted Answer

Panorama > Cloud Services > Prisma Access > Mobile Users > Traffic Steering / QoS or GlobalProtect Client Settings.. Explicit SaaS application traffic steering or bypass for Prisma Access mobile users is configured under Panorama > Cloud Services > Prisma Access > Mobile Users > Traffic Steering / QoS or GlobalProtect Client Settings. This location allows administrators to define traffic steering rules that identify SaaS applications (via App-ID or custom URL categories) and specify whether to forward, bypass, or apply QoS. It is the centralized policy point for mobile user traffic handling in Prisma Access.

Answer

Device > Setup > Content ID.

Answer

Policies > Decryption.

Answer

Objects > Custom Objects > URL Filtering.

Question 7

When troubleshooting SSL Decryption issues in a Prisma Access environment where users report certificate warnings, which THREE areas should an administrator inspect? (Choose three)

Accepted Answer

Check the Decryption Policy rules to ensure the correct traffic zones, URLs, and actions (Decrypt/No Decrypt) are configured.. Option A is correct because decryption behavior is driven by the Decryption Policy: the administrator must confirm that the correct source/destination zones, URL categories or FQDN matches, and the Decrypt/No Decrypt action are applied so intended traffic is actually decrypted rather than bypassed. Option C is correct because for Inbound (SSL Forward Proxy server-side) decryption, the rule's server certificate and private key must be correctly bound; a missing, expired, or mismatched certificate/key pair will cause handshake failures and certificate warnings. Option E is correct because Prisma Access uses Forward Trust and Forward Untrust certificates to sign re-encrypted (proxied) sessions, and if these are not issued by the organization's Enterprise CA and trusted by the endpoints, browsers will present untrusted-certificate warnings. Option B is not relevant because BGP routing for Service Connection prefixes affects reachability and path selection, not certificate trust or decryption policy evaluation. Option D is not relevant because the GlobalProtect client version on mobile workstations does not determine whether decrypted sessions present a trusted certificate; certificate warnings stem from decryption policy, certificate binding, or trust chain issues.

Answer

Verify the BGP routing table for Service Connection prefixes.

Answer

Check the GlobalProtect client version installed on mobile workstations.

Question 8

Which TWO methods can an administrator use to monitor the health and operational status of Prisma Access Service Connections in Panorama? (Choose two)

Accepted Answer

Panorama > Cloud Services > Status > Service Connections dashboard.. Option A is correct because Panorama provides a dedicated Cloud Services > Status > Service Connections dashboard that displays the health, status, and tunnel details of each Prisma Access Service Connection, giving administrators a centralized monitoring view. Option E is correct because administrators can also use operational CLI commands and monitoring tools on the service connection to inspect tunnel interface statistics and verify BGP peering or static route status, which are the key indicators of Service Connection health and reachability. The remaining options are incorrect: URL Filtering custom objects (B) are used for web content policy, NAT configuration (C) is for address translation rules, and log forwarding profiles (D) define where logs are sent — none of these monitor Service Connection operational status.

Answer

Objects > Custom Objects > URL Filtering.

Answer

Policies > NAT configuration view.

Answer

Device > Log Settings forwarding profiles.

Question 9

Which TWO commands or tools are recommended for troubleshooting routing issues on Prisma Access infrastructure? (Choose two)

Accepted Answer

CLI operational commands such as 'show routing route' or 'show routing protocol bgp' to inspect active routing tables.. Option B is correct because on Prisma Access infrastructure the CLI operational commands such as 'show routing route' and 'show routing protocol bgp' let you inspect the active routing table and BGP protocol state directly, which is exactly what is needed to diagnose route selection and peering problems. Option C is correct because the Prisma Access monitoring dashboard in Panorama surfaces BGP peer status and traffic paths, giving the recommended GUI-based view of routing health and path selection for the infrastructure. Option A is not appropriate here since Monitor > Logs > Threat shows security threat detections, not routing information. Option D is not appropriate because Device > High Availability state monitor relates to HA peer state, not routing troubleshooting. Option E is not appropriate because Objects > Custom Objects > URL Filtering is for defining URL filtering objects, which has nothing to do with routing diagnostics.

Answer

Monitor > Logs > Threat.

Answer

Device > High Availability state monitor.

Answer

Objects > Custom Objects > URL Filtering.

Question 10

An administrator is troubleshooting a Prisma Access mobile user issue where users connected via GlobalProtect cannot access local network printers or local subnet resources while connected to the VPN. Which THREE settings should be reviewed in Panorama? (Choose three)

Accepted Answer

Check the GlobalProtect Agent configuration regarding 'Access Route' or local network access permissions.. Option B is correct because the GlobalProtect Agent configuration controls whether the agent permits access to local networks; settings such as 'Allow local network access' or the Access Route configuration determine whether traffic to local printers and subnets is allowed or blocked while the tunnel is up. Option C is correct because the Split Tunnel configuration in the GlobalProtect Client Settings defines which destinations are excluded from (or included in) the tunnel; if local subnets are not properly listed in the split-tunnel exclude/include list, local printer and subnet traffic gets routed into the VPN and fails. Option D is correct because the client-side routing table must retain the local subnet gateway routes when the VPN connects; if GlobalProtect installs a default route or removes the local routes, traffic to local resources is sent over the tunnel instead of the local gateway. Option A is not relevant because the BGP AS number on the Service Connection affects routing between Prisma Access and the customer's service connection infrastructure, not a mobile user's access to their own local LAN. Option E is not relevant because WildFire file analysis submission timeout settings concern threat inspection of files and have no bearing on local subnet or printer reachability.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Check the WildFire file analysis submission timeout settings.

Question 11

An enterprise has deployed Prisma Access with multiple remote networks and mobile users. An administrator notices that threat intelligence feeds (such as malicious IP lists and dynamic address groups) are not updating. Which THREE components should be inspected to resolve this update failure? (Choose three)

Accepted Answer

Check External Dynamic List (EDL) URLs and ensure that Prisma Access nodes can successfully reach the external EDL hosting servers.. Option B is correct because External Dynamic Lists (EDLs) are fetched directly by the Prisma Access nodes (via the management plane/service infrastructure), so if the EDL URLs are malformed or the hosting servers are unreachable due to DNS, proxy, or firewall restrictions, the malicious IP lists and dynamic address groups will never refresh. Option C is correct because Panorama must have outbound internet access to reach Palo Alto Networks update servers (updates.paloaltonetworks.com) to download threat feeds, Applications and Threats content, and other dynamic updates that are then pushed to Prisma Access. Option D is correct because the Dynamic Update schedule under Device > Dynamic Updates (and its deployment status under Device Deployment) determines whether content and threat-feed updates are actually scheduled, downloaded, and applied to managed firewalls; a disabled or failed schedule directly explains stale feeds. Option A is not relevant because the BGP ASN on the Service Connection only affects routing between Prisma Access and the customer's on-premises/cloud networks, not threat intelligence feed retrieval. Option E is not relevant because the GlobalProtect portal certificate expiration affects user authentication and portal connectivity, not the updating of EDLs or threat feeds.

Answer

Verify the BGP ASN configured on the Service Connection.

Answer

Check the GlobalProtect portal certificate expiration date.

Question 12

An administrator troubleshooting a Prisma Access Mobile Users deployment notices authentication failures for users authenticating via SAML to an external IdP. The users report being stuck in an authentication loop. Which log file on Panorama should the administrator examine to troubleshoot SAML response assertion issues?

Accepted Answer

authd.log. SAML authentication failures and loops in GlobalProtect are typically logged in authd.log on Panorama. This log records authentication events, including SAML assertions and errors, making it the correct place to troubleshoot SAML response assertion issues. Other logs like traffic.log or threat.log do not contain authentication details.

Answer

traffic.log

Answer

globalProtectPortal.log

Answer

threat.log

Question 13

An administrator needs to troubleshoot a Security Policy rule that is expected to block access to unauthorized cloud storage applications in a Prisma Access environment. Where can the administrator view real-time data regarding which specific applications are being utilized by remote users?

Accepted Answer

Panorama > ACC (App-Command Center). The ACC (App-Command Center) provides visual summaries of application usage, threats, and web activity in real time.

Answer

Panorama > Setup > Operations

Answer

Panorama > Managed Devices > Summary

Answer

Prisma Access > Cloud Services > Dashboard > Status

Question 14

An administrator is investigating intermittent authentication failures for remote users connecting via GlobalProtect to Prisma Access using SAML. Which THREE log sources or troubleshooting commands can assist in identifying the root cause? (Choose three)

Accepted Answer

authd.log on Panorama/Prisma Access. Option A, authd.log on Panorama/Prisma Access, is correct because authentication daemon (authd) logging records the SAML/authentication processing on the management plane, including the exchange with the IdP and any failures in the auth sequence, which is exactly where intermittent SAML authentication errors surface. Option C, GlobalProtect app debug logs on the client endpoint, is correct because the endpoint's PanGPS debug logs capture the client-side SAML flow, including browser/embedded-browser interactions, cookie handling, and the exact point where authentication stalls or fails. Option D, globalProtectPortal.log, is correct because it records portal-level events such as configuration retrieval, client authentication, and portal-side SAML handling, helping correlate whether the failure occurs at the portal stage. Option B, a data-plane packet capture of HTTP/2 server streams, is not the right tool here because SAML authentication is handled on the management plane rather than the data plane, so a data-plane pcap would not capture the relevant authentication exchange. Option E, the Panorama ACC threat widget counters, is unrelated because ACC threat counters reflect security policy and threat detection statistics, not authentication troubleshooting.

Answer

Data-plane packet capture (pcap) of HTTP/2 server streams

Answer

Panorama ACC threat widget counters

Question 15

A Prisma Access administrator is troubleshooting a mobile user who cannot access an internal application hosted in a remote network. The user's GlobalProtect connection is established, and other users in the same remote network can access the application. The administrator suspects a routing issue within Prisma Access. Which action should the administrator take to verify the service connection routing for the remote network?

Accepted Answer

Run 'show routing route' on the service connection.. To verify service connection routing for a remote network, the administrator should run 'show routing route' on the service connection. This command reveals the routes that the service connection has learned, including those from remote networks. If the route to the internal application is missing, that explains why the mobile user cannot access it. Other options do not provide the necessary routing details.

Answer

Use the Prisma Access CLI to ping the application from the mobile user's device.

Answer

Review the GlobalProtect logs for the user.

Answer

Check the service connection status in the Prisma Access dashboard.

Question 16

A Prisma Access administrator is troubleshooting a mobile user who reports that DNS resolution for internal domains fails when connected via GlobalProtect. The administrator wants to verify the DNS suffix and search domains pushed to the client. Which tool should the administrator use?

Accepted Answer

GlobalProtect Client Settings in the Prisma Access Portal. The GlobalProtect Client Settings in the Prisma Access Portal are where DNS suffix and search domains are configured for mobile users. To troubleshoot DNS resolution issues, the administrator should verify these settings to ensure they are correctly applied. Other options do not provide the necessary configuration details.

Answer

Prisma Access Dashboard

Answer

GlobalProtect App Logs

Answer

Prisma Access CLI 'show dns-proxy' command

Question 17

A Prisma Access administrator notices that a mobile user's traffic to a sanctioned SaaS application is being blocked by a URL Filtering policy. The administrator wants to quickly verify which URL category the application is being classified under in Prisma Access. Which tool should the administrator use to check the URL category?

Accepted Answer

The URL category lookup tool in the Prisma Access portal. The URL category lookup tool in the Prisma Access portal is designed for on-demand checks of URL categorization. By entering the SaaS application's URL, the administrator can see the assigned category and then verify whether the URL Filtering policy is blocking that category. This is the fastest way to confirm classification and resolve the blocking issue.

Answer

URL Filtering logs in the Prisma Access platform

Answer

GlobalProtect app logs on the user's endpoint

Answer

Threat logs filtered by the application name

Question 18

A Prisma Access engineer is troubleshooting a Remote Networks deployment where branch users cannot reach any external websites. The engineer suspects that the IPsec tunnel is not passing traffic due to a Phase 2 mismatch. Which command should the engineer run on the branch firewall to verify the IPsec tunnel status and identify any Phase 2 issues?

Accepted Answer

show vpn ipsec-sa tunnel <tunnel-name>. The IPsec tunnel between a branch firewall and Prisma Access consists of Phase 1 (IKE SA) and Phase 2 (IPsec SA). A Phase 2 mismatch, such as differing proxy IDs, prevents traffic flow. The command that specifically displays IPsec SA status and traffic selectors is needed to confirm whether the child SA is established and correctly configured. This allows the engineer to quickly identify and resolve the mismatch.

Answer

show vpn flow name <tunnel-name>

Answer

show vpn ike-sa gateway <gateway-name> detail

Answer

show vpn ike-sa gateway <gateway-name>

Question 19

A Prisma Access administrator configured a Service Connection for a remote network at a new branch office. Branch users can reach internal applications through the tunnel, but DNS queries for the corporate internal domains are being answered by public resolvers instead of the internal DNS servers configured in the Service Connection. The administrator confirms the internal DNS servers are reachable and correctly entered in the Service Connection configuration. Which action should the administrator take to resolve this?

Accepted Answer

Verify that the internal DNS servers are included in the split tunnel / domain list of the Service Connection so corporate domains are forwarded to them.. Internal DNS resolution in Prisma Access depends on the Service Connection knowing which domains belong to the corporate environment. When those domains are listed, queries are sent to the configured internal DNS servers; otherwise the endpoint uses public resolvers and receives wrong or NXDOMAIN answers. Confirming the domain list and split-tunnel inclusion is the correct troubleshooting step.

Answer

Change the GlobalProtect portal agent configuration to force all DNS traffic through the tunnel without regard to destination.

Answer

Add the internal DNS servers to the Remote Network's static route table so the branch routes DNS queries to them directly.

Answer

Enable DNS Security on the Service Connection so that public resolvers are automatically overridden for internal domains.

Question 20

A Prisma Access administrator is troubleshooting a mobile user who experiences slow throughput when accessing the internet through GlobalProtect. The administrator suspects that the traffic is being routed through a suboptimal service connection. Which action should the administrator take to verify the user's traffic path?

Accepted Answer

Use the Prisma Access 'show user ip' command to see the user's assigned IP and associated service connection.. The 'show user ip' command is the correct tool to verify the user's traffic path because it lists the assigned IP and the service connection handling the traffic. This allows the administrator to confirm if the user is routed through a suboptimal service connection. Other options do not provide this specific mapping.

Answer

Run a traceroute from the mobile user's device to the destination.

Answer

Check the GlobalProtect logs for the user's connection details.

Answer

Review the mobile user's HIP profile for network location.

SSE-Engineer Prisma Access Troubleshooting — All Questions With Answers

While troubleshooting a Prisma Access Remote Network deployment, an engineer notices that routes advertised via BGP from the customer's data center are not appearing in the Prisma Access routing table. Where can the engineer view BGP peer status and learned routes in Panorama?

A security team reports that threat prevention signatures are not updating on Prisma Access nodes. Where in Panorama should the administrator verify the scheduling and status of dynamic updates for Prisma Access?

An enterprise deployment of Prisma Access uses explicit proxy. Users report that specific SaaS applications are failing because the proxy is stripping required HTTP headers. Where should the administrator check and modify proxy header insertion rules in Prisma Access?

When troubleshooting SSL Decryption issues in a Prisma Access environment where users report certificate warnings, which THREE areas should an administrator inspect? (Choose three)

Which TWO methods can an administrator use to monitor the health and operational status of Prisma Access Service Connections in Panorama? (Choose two)

Which TWO commands or tools are recommended for troubleshooting routing issues on Prisma Access infrastructure? (Choose two)

An administrator is troubleshooting a Prisma Access mobile user issue where users connected via GlobalProtect cannot access local network printers or local subnet resources while connected to the VPN. Which THREE settings should be reviewed in Panorama? (Choose three)

An administrator needs to troubleshoot a Security Policy rule that is expected to block access to unauthorized cloud storage applications in a Prisma Access environment. Where can the administrator view real-time data regarding which specific applications are being utilized by remote users?

An administrator is investigating intermittent authentication failures for remote users connecting via GlobalProtect to Prisma Access using SAML. Which THREE log sources or troubleshooting commands can assist in identifying the root cause? (Choose three)

A Prisma Access administrator is troubleshooting a mobile user who reports that DNS resolution for internal domains fails when connected via GlobalProtect. The administrator wants to verify the DNS suffix and search domains pushed to the client. Which tool should the administrator use?

A security administrator needs to check real-time threat logs for a specific Prisma Access mobile user who reports being blocked from accessing a malicious file. Which Panorama menu path provides the most direct access to these logs?

A network engineer is configuring Prisma Access and needs to verify the status of deployed Mobile User nodes across different regions. Which Panorama workspace is dedicated to displaying the overall health and status of Prisma Access infrastructure?

An administrator is troubleshooting a Prisma Access mobile user environment where users are unable to connect because of an invalid certificate error presented by the GlobalProtect Portal. Which configuration element in Panorama should be verified?

An administrator needs to monitor the volume of traffic passing through a specific Prisma Access Service Connection. Which monitoring tool in Panorama displays aggregated data on bandwidth usage, top applications, and top users?

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

A remote network connected via Prisma Access is experiencing packet drops due to Maximum Transmission Unit (MTU) size mismatches. Which troubleshooting technique or configuration should be verified to resolve IP packet fragmentation issues?

An administrator needs to review configuration changes made to Prisma Access settings in Panorama over the past week to determine who modified a security policy. Which log should the administrator examine?

An administrator troubleshooting a Prisma Access mobile user connectivity issue wants to verify whether the GlobalProtect gateway is actively responding to client connection requests. Where can this real-time session and gateway status be verified?

When troubleshooting a Prisma Access deployment using SAML authentication, an administrator notices that users are successfully authenticated by the IdP, but the GlobalProtect client displays an error stating 'Invalid SAML Response: Signature Validation Failed'. What is the most likely root cause?

A network engineer is configuring a new Remote Network in Prisma Access and needs to ensure that traffic from the branch office to the internet is breakout locally rather than backhauled to headquarters. How is local internet breakout verified in Prisma Access?

An administrator is investigating a security alert in Prisma Access triggered by an Anti-Spyware profile. Which log contains the detailed packet capture (pcap) or attack details for this specific event?

An administrator needs to verify whether Host Information Profile (HIP) checks are failing for a specific mobile user attempting to connect to Prisma Access. Which log should the administrator review in Panorama?

An administrator wants to check the status of active IPsec tunnels for a Prisma Access Remote Network location. Which Panorama menu path provides the most direct overview of IPsec tunnel health?

An enterprise deployment of Prisma Access uses explicit proxy. Users report that authentication prompts appear repeatedly when browsing internal web applications. What is the most likely cause of this authentication looping in an explicit proxy setup?

An administrator notices that the Panorama management server is failing to push configuration updates to Prisma Access nodes. Where should the administrator check for configuration push failure details and error logs in Panorama?

An administrator needs to verify the license status and active subscriptions (such as WildFire, Threat Prevention, and URL Filtering) for Prisma Access in Panorama. Which menu path should be used?

A network engineer is troubleshooting why a specific security policy rule configured in Panorama is not matching traffic in a Prisma Access environment. Which Panorama testing tool simulates traffic against security rules to verify rule evaluation?

An administrator wants to view historical bandwidth utilization trends for a specific Remote Network location over the past 30 days. Which Panorama monitoring workspace provides this historical reporting?

An administrator needs to verify whether a Prisma Access Remote Network is successfully exchanging routes with the customer CPE router over BGP. Where can the real-time BGP peer state be checked?

An administrator is troubleshooting a policy where applications are being identified incorrectly in Prisma Access. Which tool should be used to inspect how Prisma Access performs App-ID identification on a live stream of packets?

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

An administrator needs to verify the exact version of Prisma Access running on the cloud infrastructure. Where in Panorama is this version information displayed?

An enterprise deployment of Prisma Access utilizes Kerberos authentication for mobile users. Users report frequent authentication prompt failures when connecting via GlobalProtect from external networks. What is the most likely root cause of Kerberos authentication failure in this scenario?

An administrator wants to verify that threat prevention signatures are actively blocking simulated malicious traffic in a Prisma Access environment. Which testing tool or procedure is standard for verifying threat signatures safely?

A network engineer is troubleshooting an IPsec site-to-site tunnel failure between a customer CPE and a Prisma Access Remote Network. The IKE phase 1 negotiations fail. Which log should the engineer examine to determine the exact reason for the IKE negotiation failure?

Which TWO actions should an administrator take when troubleshooting an IPsec site-to-site tunnel failure between a customer CPE device and a Prisma Access Remote Network node? (Choose two)

An administrator is troubleshooting a Prisma Access mobile user deployment where GlobalProtect clients are unable to connect. Which THREE components or settings should the administrator inspect to resolve the connection failure? (Choose three)

Which TWO tools or logs in Panorama should an administrator use when troubleshooting a security policy rule that is unexpectedly dropping legitimate user traffic in Prisma Access? (Choose two)

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Which TWO actions should an administrator perform when troubleshooting User-ID mapping failures for mobile users in Prisma Access? (Choose two)

Which TWO logs or monitoring views in Panorama are essential when troubleshooting a remote network user's inability to reach a specific cloud application via Prisma Access? (Choose two)

An administrator is troubleshooting a Prisma Access environment where threat prevention profiles are failing to block known malicious file downloads. Which THREE settings or logs should the administrator investigate? (Choose three)

An administrator is troubleshooting a Prisma Access deployment experiencing intermittent packet drops and high latency across remote branches. Which THREE diagnostic steps or tools should be used? (Choose three)

Which TWO actions should an administrator take to troubleshoot an authentication failure when mobile users attempt to log into Prisma Access using SAML? (Choose two)

An enterprise network team is troubleshooting a Prisma Access Remote Network deployment where DNS queries from branch offices are failing to resolve internal resources. Which THREE components should be inspected? (Choose three)

An administrator is troubleshooting a Prisma Access explicit proxy deployment where users report that specific web applications are failing with connection timeout errors. Which THREE areas should the administrator check? (Choose three)

Which TWO configuration steps should an administrator verify when troubleshooting an issue where Panorama cannot push updates or configurations to Prisma Access nodes? (Choose two)

Which TWO logs should an administrator check in Panorama when troubleshooting a mobile user who reports that their connection keeps dropping after a short period of time? (Choose two)

An administrator is troubleshooting a Prisma Access deployment where specific applications are identified as 'incomplete' or 'unknown-tcp' in the Traffic logs. Which THREE factors or troubleshooting steps should be evaluated? (Choose three)

Which TWO troubleshooting methods are effective when verifying whether Host Information Profile (HIP) checks are operating correctly for Prisma Access mobile users? (Choose two)

Which TWO actions should an administrator take when troubleshooting high CPU utilization on Prisma Access cloud infrastructure nodes? (Choose two)

An enterprise network administrator is troubleshooting an IPsec tunnel failure between a remote network and Prisma Access where Dead Peer Detection (DPD) keeps tearing down the tunnel. Which THREE potential causes should be investigated? (Choose three)

A remote user reports that their GlobalProtect connection connects successfully to Prisma Access, but they cannot resolve internal fully qualified domain names (FQDNs). Where should the administrator check to ensure DNS server IP addresses are correctly pushed to the GlobalProtect client?

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch office users cannot reach external websites. Which TWO configuration areas or logs should the administrator check to resolve this issue? (Choose two)

When troubleshooting a Prisma Access deployment where traffic from remote users is failing Threat Prevention inspection, which TWO components or configurations must be verified? (Choose two)

A Prisma Access administrator is troubleshooting an issue where mobile users intermittently lose access to all applications for a few seconds. The administrator suspects an issue with the GlobalProtect tunnel. Which tool should the administrator use to view the tunnel status and identify flapping?

A Prisma Access administrator needs to verify that a specific mobile user's traffic is being inspected by the correct security policy rule. The administrator wants to see the rule name that allowed or denied a recent session. Which log type should the administrator consult?

A Prisma Access administrator is troubleshooting a remote network site where IPsec tunnels are flapping. The administrator suspects that the tunnel monitoring settings are too aggressive. Which configuration parameter should be adjusted to reduce flapping?

A Prisma Access administrator needs to verify that the GlobalProtect portal is presenting the correct certificate to mobile users during authentication. Which tool should the administrator use to inspect the certificate presented by the portal?