SSE-Engineer Prisma Access Troubleshooting Practice Test 3 — 15 Questions

Question 1

An organization uses SAML authentication with Prisma Access for mobile users. Users report an intermittent 'Authentication Failed' error when trying to establish a GlobalProtect connection. The Identity Provider (IdP) logs show successful authentication, but Prisma Access logs indicate a failure. What is the most likely cause of this discrepancy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Clock skew between the SAML Identity Provider and the Prisma Access service nodes exceeding the allowed tolerance window.. Intermittent SAML authentication failures where the IdP logs success but Prisma Access logs failure are most commonly caused by clock skew between the IdP and Prisma Access service nodes exceeding the allowed tolerance (typically 5 minutes). SAML assertions include timestamps (NotBefore, NotOnOrAfter) that are validated; if the clocks are not synchronized, the assertion may be considered expired or not yet valid.

Answer

The GlobalProtect client software license has expired on Panorama.

Answer

The User-ID agent service on the Panorama management server is stopped.

Answer

WildFire cloud subscription has lapsed.

Question 2

An administrator notices that a subset of mobile users connecting via GlobalProtect in Prisma Access cannot resolve internal corporate hostnames, while external websites load normally. The split-tunnel configuration includes the corporate domain. Where should the administrator check first in Panorama to troubleshoot this DNS resolution failure?

Accepted Answer

Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config > DNS and-or WINS.. DNS and WINS settings for GlobalProtect mobile users are configured under Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config. If internal hostnames fail to resolve while external sites work, the DNS server list or suffix pushed to clients is likely missing or incorrect, so this is the first place to verify. The split-tunnel domain inclusion only routes traffic; it does not supply DNS servers.

Answer

Panorama > Prisma Access > Monitoring > ACC.

Answer

Panorama > Cloud Services > Status > Traffic Log.

Answer

Panorama > Firewall > Network Profiles > Interface.

Question 3

A network engineer is configuring Prisma Access and needs to verify the status of deployed Mobile User nodes across different regions. Which Panorama workspace is dedicated to displaying the overall health and status of Prisma Access infrastructure?

Accepted Answer

Panorama > Cloud Services > Status.. Panorama > Cloud Services > Status is the dedicated workspace that displays the overall health and status of Prisma Access infrastructure, including Mobile User and Remote Network nodes across regions. It shows service status, license usage, and node health. The other options are unrelated configuration or monitoring areas.

Answer

Objects > Certificates.

Answer

Policies > QoS.

Answer

Monitor > Managed Devices.

Question 4

An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?

Accepted Answer

Inspect the custom application definitions and ensure Custom App-IDs are mapped to the correct non-standard ports, and that security rules permit those ports.. Prisma Access App-ID inspection relies on application signatures that map to specific TCP/UDP ports. When an application runs on a non-standard port, the default App-ID signature won't match, so the session may be dropped or misclassified. Creating a Custom App-ID that explicitly lists the non-standard port, then referencing it in a security rule that permits that port, allows the traffic to be identified and inspected correctly through the explicit/transparent proxy.

Answer

Configure a static NAT rule for the non-standard ports on the service connection.

Answer

Disable GlobalProtect pre-logon mode.

Answer

Enable SSL Forward Proxy on the destination zones.

Question 5

An administrator is troubleshooting a Prisma Access mobile user environment where users are unable to connect because of an invalid certificate error presented by the GlobalProtect Portal. Which configuration element in Panorama should be verified?

Accepted Answer

Verify that the SSL/TLS certificate assigned to the GlobalProtect Portal configuration is valid, not expired, and trusted by the client devices.. The GlobalProtect Portal presents an SSL/TLS certificate to connecting clients during the portal handshake. If that certificate is expired, self-signed without a trusted chain, or has a mismatched CN/SAN, clients will reject the connection with an invalid certificate error before any tunnel or authentication occurs. The correct remediation is to verify the certificate assigned under Panorama > Cloud Services > Prisma Access > GlobalProtect Portal configuration is valid and trusted by the endpoints.

Answer

Check the IPsec crypto profile under Network > Network Profiles > IPsec Crypto.

Answer

Check the User-ID agent connection timeout settings.

Answer

Verify the BGP AS number on the Remote Network node.

Question 6

An administrator needs to monitor the volume of traffic passing through a specific Prisma Access Service Connection. Which monitoring tool in Panorama displays aggregated data on bandwidth usage, top applications, and top users?

Accepted Answer

Monitor > ACC (Application Command Center).. The correct tool is Monitor > ACC (Application Command Center) (C). ACC provides aggregated dashboards showing bandwidth usage, top applications, top users, and other traffic analytics. It is designed for monitoring traffic patterns and volumes across the network, including Service Connections in Prisma Access.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Device > Log Settings.

Answer

Policies > QoS.

Question 7

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

Accepted Answer

Panorama > Cloud Services > Setup > Support.. TSFs for Prisma Access can be generated under Panorama > Cloud Services > Setup > Support.

Answer

Device > Support > Tech Support File.

Answer

Monitor > Logs > System.

Answer

Policies > Security.

Question 8

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

Accepted Answer

Use the CLI operational command 'show user ip-user-mapping all' or check User-ID status in the Prisma Access monitoring dashboard.. The CLI command 'show user ip-user-mapping all' displays the current IP-to-user mappings, and the Prisma Access monitoring dashboard shows User-ID status. This directly verifies whether User-ID mappings are populated for mobile users, which is required for user/group-based policy matching. If mappings are missing, policies won't match.

Answer

Check the GlobalProtect Gateway tunnel status.

Answer

Run 'show system software status'.

Answer

Verify the SSL Decryption certificate expiration date.

Question 9

A remote network connected via Prisma Access is experiencing packet drops due to Maximum Transmission Unit (MTU) size mismatches. Which troubleshooting technique or configuration should be verified to resolve IP packet fragmentation issues?

Accepted Answer

Enable TCP MSS clamping on the IPsec tunnel settings or ensure the local CPE device correctly handles ICMP Destination Unreachable messages.. MTU mismatches cause fragmentation issues when packets exceed the path MTU and ICMP 'fragmentation needed' messages are blocked. Enabling TCP MSS clamping on the IPsec tunnel forces the maximum segment size to fit within the tunnel MTU, preventing fragmentation, while ensuring the CPE handles ICMP Destination Unreachable (Type 3, Code 4) allows Path MTU Discovery to function correctly.

Answer

Change the mobile user authentication type from SAML to RADIUS.

Answer

Configure a WildFire analysis profile to bypass large files.

Answer

Increase the GlobalProtect client idle timeout value to 3600 seconds.

Question 10

An administrator needs to review configuration changes made to Prisma Access settings in Panorama over the past week to determine who modified a security policy. Which log should the administrator examine?

Accepted Answer

Monitor > Logs > Config.. The Config log (Monitor > Logs > Config) records all configuration changes made in Panorama, including who made the change, when, and what was modified. This is the correct log to review to determine who altered a security policy over the past week.

Answer

Monitor > Logs > Threat.

Answer

Monitor > Logs > Data Filtering.

Answer

Monitor > Logs > Traffic.

Question 11

A Prisma Access deployment utilizes Service Connections to connect to a corporate data center. An administrator notices that traffic destined for internal data center subnets is being sent out to the internet instead of the Service Connection. What is the most likely cause of this routing misconfiguration?

Accepted Answer

Missing or incorrect static routes / BGP route advertisements for the internal subnets in the Service Connection routing configuration.. Service Connections in Prisma Access require explicit routing configuration — either static routes or BGP advertisements — to direct traffic for internal data center subnets over the Service Connection tunnel. If those routes are missing or incorrect, Prisma Access has no path for the internal subnets and falls back to the default route, sending the traffic out to the internet.

Answer

WildFire inspection is enabled on the security policy rule.

Answer

The Security Predefined Policy rule order is incorrect.

Answer

The GlobalProtect Portal client timeout is set too low.

Question 12

An administrator troubleshooting a Prisma Access mobile user connectivity issue wants to verify whether the GlobalProtect gateway is actively responding to client connection requests. Where can this real-time session and gateway status be verified?

Accepted Answer

Panorama > Cloud Services > Status > Mobile Users > Gateways.. The status of GlobalProtect gateways for Prisma Access mobile users, including real-time session and gateway responsiveness, is verified under Panorama > Cloud Services > Status > Mobile Users > Gateways. This page shows gateway status, connected users, and health metrics for the Prisma Access mobile user infrastructure.

Answer

Policies > Decryption.

Answer

Device > Setup > Operations.

Answer

Objects > Addresses.

Question 13

When troubleshooting a Prisma Access deployment using SAML authentication, an administrator notices that users are successfully authenticated by the IdP, but the GlobalProtect client displays an error stating 'Invalid SAML Response: Signature Validation Failed'. What is the most likely root cause?

Accepted Answer

The IdP signing certificate imported into the Prisma Access authentication profile does not match the active certificate currently used by the IdP.. The error 'Invalid SAML Response: Signature Validation Failed' means the GlobalProtect/Prisma Access SAML authentication profile could not verify the digital signature on the SAML assertion returned by the IdP. This almost always occurs when the signing certificate configured in the authentication profile does not match the certificate the IdP is currently using to sign assertions—typically because the IdP rotated its certificate and the old one is still imported.

Answer

The decryption policy is blocking HTTPS traffic to the IdP.

Answer

The User-ID agent service on Panorama has crashed.

Answer

The GlobalProtect client version is outdated and does not support SAML.

Question 14

A network engineer is configuring a new Remote Network in Prisma Access and needs to ensure that traffic from the branch office to the internet is breakout locally rather than backhauled to headquarters. How is local internet breakout verified in Prisma Access?

Accepted Answer

Verify that 'Local Internet Breakout' is enabled in the Remote Network configuration and examine Traffic logs to confirm internet-bound sessions egress through the Remote Network's assigned public IP.. Local internet breakout in Prisma Access is verified by confirming the 'Local Internet Breakout' setting is enabled in the Remote Network configuration and then examining Traffic logs to ensure internet-bound sessions egress through the Remote Network's assigned public IP rather than being backhauled to headquarters. This directly validates both the configuration intent and the actual traffic path. The Traffic logs show source and destination NAT details, egress interface, and the public IP used, providing definitive proof of local breakout.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Ensure SSL Forward Proxy is disabled on the Security Policy.

Answer

Check the GlobalProtect Portal client configuration settings.

Question 15

An administrator is investigating a security alert in Prisma Access triggered by an Anti-Spyware profile. Which log contains the detailed packet capture (pcap) or attack details for this specific event?

Accepted Answer

Monitor > Logs > Threat.. In Prisma Access and PAN-OS, threat logs (Monitor > Logs > Threat) record all events generated by security profiles including Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire. When an Anti-Spyware profile triggers an alert, the detailed attack information — including the threat name, severity, source/destination, and often a packet capture (pcap) if configured — is stored in the Threat log. This is the correct location to investigate the specific event.

Answer

Monitor > Logs > HIP Match.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > URL Filtering.