SSE-Engineer Prisma Access Troubleshooting Practice Test 2 — 15 Questions

Question 1

A Prisma Access administrator is troubleshooting a mobile user who reports that DNS resolution for internal domains fails when connected via GlobalProtect. The administrator wants to verify the DNS suffix and search domains pushed to the client. Which tool should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GlobalProtect Client Settings in the Prisma Access Portal. The GlobalProtect Client Settings in the Prisma Access Portal are where DNS suffix and search domains are configured for mobile users. To troubleshoot DNS resolution issues, the administrator should verify these settings to ensure they are correctly applied. Other options do not provide the necessary configuration details.

Answer

Prisma Access Dashboard

Answer

GlobalProtect App Logs

Answer

Prisma Access CLI 'show dns-proxy' command

Question 2

A Prisma Access administrator notices that a mobile user's traffic to a sanctioned SaaS application is being blocked by a URL Filtering policy. The administrator wants to quickly verify which URL category the application is being classified under in Prisma Access. Which tool should the administrator use to check the URL category?

Accepted Answer

The URL category lookup tool in the Prisma Access portal. The URL category lookup tool in the Prisma Access portal is designed for on-demand checks of URL categorization. By entering the SaaS application's URL, the administrator can see the assigned category and then verify whether the URL Filtering policy is blocking that category. This is the fastest way to confirm classification and resolve the blocking issue.

Answer

URL Filtering logs in the Prisma Access platform

Answer

GlobalProtect app logs on the user's endpoint

Answer

Threat logs filtered by the application name

Question 3

A Prisma Access engineer is troubleshooting a Remote Networks deployment where branch users cannot reach any external websites. The engineer suspects that the IPsec tunnel is not passing traffic due to a Phase 2 mismatch. Which command should the engineer run on the branch firewall to verify the IPsec tunnel status and identify any Phase 2 issues?

Accepted Answer

show vpn ipsec-sa tunnel <tunnel-name>. The IPsec tunnel between a branch firewall and Prisma Access consists of Phase 1 (IKE SA) and Phase 2 (IPsec SA). A Phase 2 mismatch, such as differing proxy IDs, prevents traffic flow. The command that specifically displays IPsec SA status and traffic selectors is needed to confirm whether the child SA is established and correctly configured. This allows the engineer to quickly identify and resolve the mismatch.

Answer

show vpn flow name <tunnel-name>

Answer

show vpn ike-sa gateway <gateway-name> detail

Answer

show vpn ike-sa gateway <gateway-name>

Question 4

A Prisma Access administrator configured a Service Connection for a remote network at a new branch office. Branch users can reach internal applications through the tunnel, but DNS queries for the corporate internal domains are being answered by public resolvers instead of the internal DNS servers configured in the Service Connection. The administrator confirms the internal DNS servers are reachable and correctly entered in the Service Connection configuration. Which action should the administrator take to resolve this?

Accepted Answer

Verify that the internal DNS servers are included in the split tunnel / domain list of the Service Connection so corporate domains are forwarded to them.. Internal DNS resolution in Prisma Access depends on the Service Connection knowing which domains belong to the corporate environment. When those domains are listed, queries are sent to the configured internal DNS servers; otherwise the endpoint uses public resolvers and receives wrong or NXDOMAIN answers. Confirming the domain list and split-tunnel inclusion is the correct troubleshooting step.

Answer

Change the GlobalProtect portal agent configuration to force all DNS traffic through the tunnel without regard to destination.

Answer

Add the internal DNS servers to the Remote Network's static route table so the branch routes DNS queries to them directly.

Answer

Enable DNS Security on the Service Connection so that public resolvers are automatically overridden for internal domains.

Question 5

A Prisma Access administrator is troubleshooting a mobile user who reports that DNS resolution for internal domains fails when connected via GlobalProtect. The administrator wants to verify the DNS suffix and search domains pushed to the client. Which tool should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Prisma Access 'show user ip' command to see the user's assigned IP and associated service connection.. The 'show user ip' command is the correct tool to verify the user's traffic path because it lists the assigned IP and the service connection handling the traffic. This allows the administrator to confirm if the user is routed through a suboptimal service connection. Other options do not provide this specific mapping.

Answer

Run a traceroute from the mobile user's device to the destination.

Answer

Check the GlobalProtect logs for the user's connection details.

Answer

Review the mobile user's HIP profile for network location.

Question 6

A Prisma Access administrator is troubleshooting a mobile user who reports that DNS resolution for internal domains fails when connected via GlobalProtect. The administrator wants to verify the DNS suffix and search domains pushed to the client. Which tool should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remote Network tunnel interface. The remote network tunnel interface is the correct component to inspect because it handles routing for traffic entering and leaving the remote network. When the IPsec tunnel is up and the branch subnet is correctly configured, the next logical step is to verify that the tunnel interface has proper routes for internal subnets. Without correct routing on that interface, traffic destined for internal applications will be dropped or misrouted.

Answer

Service Connection

Answer

GlobalProtect portal

Answer

Content update schedule

Question 7

A Prisma Access administrator is troubleshooting a mobile user who reports that DNS resolution for internal domains fails when connected via GlobalProtect. The administrator wants to verify the DNS suffix and search domains pushed to the client. Which tool should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Traffic logs in Strata Logging Service and filter by the user and application.. Traffic logs in both Strata Logging Service and Prisma Access Insights record the policy rule that matched and the action taken. By filtering for the specific user and application, the administrator can see the denied session and the exact rule causing the block. Both logs provide this information, making them the correct choices to quickly identify the blocking policy.

Answer

Check the HIP match logs to see if the user's device is compliant.

Answer

Run a packet capture on the GlobalProtect gateway to see the deny.

Answer

Use the Policy Optimizer in Prisma Access to view rule hit counts.

Question 8

A security engineer is troubleshooting a Prisma Access mobile user who cannot access an internal web server after successfully connecting via GlobalProtect. The engineer confirms that the user's traffic is reaching Prisma Access and that the internal web server is reachable from other mobile users. Which troubleshooting step should the engineer perform next to determine why this specific user is being blocked?

Accepted Answer

Check the user's group membership in the identity source. The most direct next step is to check the user's group membership in the identity source because the problem is isolated to one user while others can access the same internal server. If the user is not in the correct group, they will not match the security policy that permits access. Verifying group membership and ensuring that Prisma Access has the correct user-to-group mapping will confirm whether the issue is identity-related.

Answer

Verify the content update version on the firewall

Answer

Restart the GlobalProtect service on the user's endpoint

Answer

Review the user's HIP profile and matching HIP policy

Question 9

A Prisma Access administrator wants to verify that a recently created security policy rule is actually being evaluated for mobile user traffic. The administrator has the username and the approximate time of an access attempt that should have matched the rule. Which tool should the administrator use to see the policy evaluation trace for that specific session?

Accepted Answer

The Policy Match / Test Policy Match tool, which simulates the session and shows which rule is evaluated and matched.. To confirm that a specific rule is evaluated for a user's traffic, the policy match test tool is the right choice because it simulates the session with the provided parameters and displays the evaluation result. It isolates policy logic from log timing and shows precisely which rule would match for the given user and destination.

Answer

The Policy Optimizer in the Prisma Access app, which shows rule usage statistics over time.

Answer

The Traffic Log filtered by the username and destination, which shows the matched rule in the session details.

Answer

The Threat Log filtered by the username, which records every rule evaluation for that user.

Question 10

A Prisma Access administrator is troubleshooting a mobile user who reports that DNS resolution for internal domains fails when connected via GlobalProtect. The administrator wants to verify the DNS suffix and search domains pushed to the client. Which tool should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user's browser is using QUIC, which bypasses SSL decryption and prevents URL categorization.. The session is decrypted but the URL category remains 'unknown', which is a classic sign that the application is using QUIC (HTTP/3) over UDP 443. QUIC bypasses SSL decryption unless explicitly blocked or decrypted. The correct action is to block QUIC or enforce decryption for UDP 443, allowing the firewall to categorize the traffic properly and apply the URL Filtering policy.

Answer

The URL Filtering policy is applied to the wrong zone, so the traffic is not being evaluated by the correct rule.

Answer

The SaaS application's URL category is not present in the local URL database, requiring a content update.

Answer

The SSL decryption profile is not configured to forward the decrypted traffic to the URL Filtering engine.

Question 11

A Prisma Access administrator is investigating why a remote network's IPsec tunnel to Prisma Access is flapping. The tunnel status shows intermittent up/down, and users experience brief outages. The administrator checks the IKE logs and sees repeated 'INVALID_COOKIE' notifications. What is the most likely cause of this issue?

Accepted Answer

The IKEv2 cookie challenge is failing because the remote peer is behind a NAT device that modifies the source port.. The 'INVALID_COOKIE' notification in IKEv2 indicates that the cookie challenge response from the remote peer is invalid. This commonly occurs when a NAT device between the peer and Prisma Access alters the source port, causing the cookie calculation to fail. The tunnel flaps as a result. Ensuring NAT-Traversal is properly configured and that the NAT device maintains consistent port mapping resolves the issue.

Answer

The pre-shared key is incorrect, causing authentication failures and tunnel resets.

Answer

The remote network's public IP address is changing frequently due to a dynamic ISP assignment.

Answer

The IPsec proposal is mismatched, leading to IKE SA renegotiation failures.

Question 12

A Prisma Access administrator is troubleshooting a mobile user who reports that DNS resolution for internal domains fails when connected via GlobalProtect. The administrator wants to verify the DNS suffix and search domains pushed to the client. Which tool should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the routing table on the service connection to ensure the internal subnet is advertised.. To verify the routing path, the administrator must check both the service connection's routing table and the remote network's BGP advertisements. The service connection must have a route to the internal subnet, and the remote network must advertise that subnet via BGP. These two checks confirm that the route exists and is propagated correctly, which are critical for mobile user access.

Answer

Check the GlobalProtect app logs on the user's device for DNS resolution errors.

Answer

Run a traceroute from the mobile user's device to the internal application to identify the hop where traffic fails.

Answer

Use the Prisma Access CLI to run 'show routing route' on the mobile user's gateway.

Question 13

A Prisma Access administrator is troubleshooting a mobile user who reports that DNS resolution for internal domains fails when connected via GlobalProtect. The administrator wants to verify the DNS suffix and search domains pushed to the client. Which tool should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The remote network's NAT policy is not translating the source IP addresses of internal hosts.. When a remote network routes internet-bound traffic through Prisma Access, the internal private IP addresses must be translated to a public IP via NAT. Without NAT, Prisma Access cannot forward the traffic to the internet, resulting in no connectivity. The tunnel being up but no traffic passing is a classic symptom of missing NAT on the remote network's firewall.

Answer

The IPsec tunnel is configured with the wrong pre-shared key, causing silent drops.

Answer

The remote network's security policy is blocking all traffic from the trust zone to the untrust zone.

Answer

The remote network's BGP configuration is not advertising the default route to Prisma Access.

Question 14

An administrator implements a new Decryption policy in Prisma Access to inspect inbound traffic to a public-facing application hosted behind a Prisma Access Public IP. After deployment, users report receiving certificate warning errors. What should the administrator inspect first to resolve the warning?

Accepted Answer

Verify that the correct server certificate and private key are imported into Panorama and bound to the Inbound Decryption rule.. When inbound decryption is configured for a public-facing application behind a Prisma Access Public IP, the firewall acts as a reverse proxy and must present a server certificate that matches the application's FQDN. If the wrong certificate or private key is bound to the Inbound Decryption rule, users receive certificate warnings. The first thing to verify is that the correct server certificate and private key are imported into Panorama and bound to the rule.

Answer

Check whether the GlobalProtect client version on the user's laptop is up to date.

Answer

Ensure that WildFire analysis is disabled for inbound decrypted traffic.

Answer

Verify the OCSP responder settings under Device > Setup > Sessions.

Question 15

A security administrator needs to check real-time threat logs for a specific Prisma Access mobile user who reports being blocked from accessing a malicious file. Which Panorama menu path provides the most direct access to these logs?

Accepted Answer

Monitor > Logs > Threat.. Real-time threat logs in Panorama are accessed via Monitor > Logs > Threat, which aggregates threat logs from all managed firewalls, including Prisma Access mobile user traffic. This is the most direct path to view detailed threat events such as blocked malicious file downloads for a specific user.

Answer

Panorama > Cloud Services > Setup > Management.

Answer

Prisma Access > Service Setup > Locations.

Answer

Policies > Security.