SSE-Engineer Prisma Access Troubleshooting Practice Test 4 — 15 Questions

Question 1

An organization notices that mobile users connecting to Prisma Access from a specific country are experiencing high latency and frequent disconnections. The administrator wants to check the regional Prisma Access node performance and status. Which feature in Panorama provides regional status and cloud infrastructure metrics?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Panorama > Cloud Services > Status > Locations / Remote Networks / Mobile Users.. Panorama > Cloud Services > Status > Locations / Remote Networks / Mobile Users provides regional status and cloud infrastructure metrics for Prisma Access. This feature shows the health, performance, and status of Prisma Access nodes across different regions, allowing administrators to identify latency or disconnection issues tied to a specific location. It is the centralized monitoring point for regional infrastructure health.

Answer

Policies > QoS > Bandwidth Management.

Answer

Device > High Availability.

Answer

Monitor > Traffic > GlobalProtect Analytics.

Question 2

An administrator needs to verify whether Host Information Profile (HIP) checks are failing for a specific mobile user attempting to connect to Prisma Access. Which log should the administrator review in Panorama?

Accepted Answer

Monitor > Logs > HIP Match.. HIP Match logs in Panorama (Monitor > Logs > HIP Match) record the results of Host Information Profile checks, including which HIP profiles matched or failed for a connecting endpoint. This is the correct log to determine whether HIP checks are failing for a specific mobile user. Threat, System, and Audit logs do not contain HIP match results.

Answer

Monitor > Logs > Threat.

Answer

Monitor > Logs > System.

Answer

Panorama > Cloud Services > Audit Log.

Question 3

An administrator wants to check the status of active IPsec tunnels for a Prisma Access Remote Network location. Which Panorama menu path provides the most direct overview of IPsec tunnel health?

Accepted Answer

Panorama > Cloud Services > Status > Remote Networks.. Panorama > Cloud Services > Status > Remote Networks provides a consolidated view of each Remote Network node's health, including IPsec tunnel status, BGP peering state, and bandwidth utilization. This is the most direct path to check whether the IPsec tunnels for a specific remote network location are up or down.

Answer

Policies > Security.

Answer

Device > High Availability.

Answer

Monitor > Traffic.

Question 4

An enterprise user reports that when connected to Prisma Access Mobile Users, certain internal applications load extremely slowly or fail to render images. Investigation reveals that packet fragmentation is occurring. Which Prisma Access setting should the administrator adjust to mitigate this fragmentation issue for mobile users?

Accepted Answer

Configure TCP MSS adjustment on the GlobalProtect tunnel settings or reduce the tunnel interface MTU.. TCP MSS adjustment (or lowering the tunnel interface MTU) is the correct fix because fragmentation on the GlobalProtect/Prisma Access tunnel occurs when the encapsulated packet exceeds the path MTU. By clamping TCP MSS on the tunnel or reducing the tunnel MTU, the endpoint negotiates a smaller segment size so packets fit inside the tunnel without fragmenting. This directly addresses the root cause of slow/failed rendering for mobile users.

Answer

Change the mobile user IP pool subnet mask from /24 to /16.

Answer

Disable WildFire file forwarding for large files.

Answer

Increase the decryption profile timeout value.

Question 5

A security administrator is troubleshooting a URL Filtering policy in Prisma Access where users are able to access a category that should be blocked. Which tool in Panorama should the administrator use to test and verify which URL category a specific website falls under and which policy rule applies?

Accepted Answer

Use the URL Filtering lookup tool in Panorama or test via 'test url ' in the CLI.. Panorama's URL Filtering lookup tool and the CLI 'test url ' command query the URL categorization database and show which category a site belongs to and which policy rule matches. This is the direct way to verify why a URL is or isn't being blocked. It removes guesswork from URL Filtering troubleshooting.

Answer

Review the ACC top applications widget.

Answer

Check the GlobalProtect gateway connection status.

Answer

Examine the System log for category update errors.

Question 6

An administrator configures a Service Connection in Prisma Access to reach an on-premises Active Directory domain controller for authentication. Users are able to log in, but User-ID is failing to map IP addresses to usernames for users behind the Remote Network. What is the most likely reason for this User-ID failure?

Accepted Answer

User-ID agent or Panorama redistribution is not configured to poll the internal Domain Controller across the Service Connection, or security rules block User-ID traffic.. User-ID mapping requires the firewall (or a User-ID agent/Panorama) to actively query domain controllers via WMI/ WinRM or read security event logs to correlate IP addresses with usernames. When users authenticate through a Service Connection to an on-premises DC but User-ID mapping fails, the most common cause is that no User-ID agent or Panorama-based redistribution is configured to poll that internal DC across the Service Connection, or security policy is blocking the User-ID traffic (WMI/RPC/NetBIOS) between Prisma Access and the DC.

Answer

The GlobalProtect client certificate has expired.

Answer

BGP routing is disabled on the GlobalProtect gateway.

Answer

WildFire subscription is expired.

Question 7

An enterprise deployment of Prisma Access uses explicit proxy. Users report that authentication prompts appear repeatedly when browsing internal web applications. What is the most likely cause of this authentication looping in an explicit proxy setup?

Accepted Answer

Missing proxy bypass entries for authentication provider login pages or incorrect cookie persistence settings in the explicit proxy profile.. In an explicit proxy deployment, authentication looping typically occurs when the proxy intercepts the identity provider's login pages or when cookie persistence is misconfigured, causing the proxy to challenge the user repeatedly instead of honoring the authentication cookie. Adding proxy bypass entries for authentication provider URLs and correcting cookie persistence settings in the explicit proxy profile resolves the loop.

Answer

The BGP hold timer is set too low on the Service Connection.

Answer

SSL Forward Proxy decryption is disabled on the untrust zone.

Answer

The GlobalProtect agent version is incompatible with explicit proxy.

Question 8

An administrator notices that the Panorama management server is failing to push configuration updates to Prisma Access nodes. Where should the administrator check for configuration push failure details and error logs in Panorama?

Accepted Answer

Panorama > Job Status or Monitor > Logs > Config / System.. Panorama surfaces configuration push results and errors in two places: the Job Status view (Panorama > Job Status) shows the outcome of each commit/push job including success, failure, and warnings, while Monitor > Logs > Config and Monitor > Logs > System capture the detailed config and system-level error messages generated during the push. Together these are the authoritative locations for diagnosing why a push to Prisma Access nodes failed.

Answer

Cloud Services > Status > Remote Networks.

Answer

Device > High Availability.

Answer

Policies > Security > Audit.

Question 9

An administrator needs to verify the license status and active subscriptions (such as WildFire, Threat Prevention, and URL Filtering) for Prisma Access in Panorama. Which menu path should be used?

Accepted Answer

Panorama > Cloud Services > Setup > Licenses or Panorama > License.. In Panorama managing Prisma Access, license and subscription information — including WildFire, Threat Prevention, URL Filtering, and other Prisma Access subscriptions — is viewed under Panorama > Cloud Services > Setup > Licenses, or alternatively under Panorama > License depending on the Panorama version and deployment. This is where administrators verify active subscriptions and license status for the Prisma Access tenant.

Answer

Monitor > Logs > System.

Answer

Objects > Applications.

Answer

Policies > NAT.

Question 10

A network engineer is troubleshooting why a specific security policy rule configured in Panorama is not matching traffic in a Prisma Access environment. Which Panorama testing tool simulates traffic against security rules to verify rule evaluation?

Accepted Answer

Use the Panorama CLI command 'test security-policy-match source destination application '. The correct tool is the Panorama CLI command 'test security-policy-match source destination application ' (D). This command simulates traffic against the security policy rulebase and shows which rule would match, including the rule name, action, and other details. It is the standard method for verifying rule evaluation in Prisma Access and Panorama-managed environments.

Answer

Review the Audit log for policy changes.

Answer

Check the ACC top threats widget.

Answer

Run 'show system state'.

Question 11

An administrator wants to view historical bandwidth utilization trends for a specific Remote Network location over the past 30 days. Which Panorama monitoring workspace provides this historical reporting?

Accepted Answer

Monitor > Reports.. Panorama's Monitor > Reports workspace provides historical reporting, including bandwidth utilization trends over time for managed firewalls and Remote Network locations. This is where you access predefined and custom reports that aggregate data over days, weeks, or months, making it the correct place to view 30-day bandwidth trends.

Answer

Device > Setup > Management.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Policies > QoS.

Question 12

An administrator needs to verify whether a Prisma Access Remote Network is successfully exchanging routes with the customer CPE router over BGP. Where can the real-time BGP peer state be checked?

Accepted Answer

Run operational CLI commands such as 'show routing protocol bgp peer' or check the routing status in the Prisma Access monitoring dashboard.. Prisma Access Remote Networks use BGP to exchange routes between the customer CPE and the Prisma Access service connection. The authoritative way to verify real-time BGP peer state is through operational commands like 'show routing protocol bgp peer' on the relevant node or via the Prisma Access monitoring dashboard's routing status view. These tools display the current BGP session state (e.g., Established, Idle, Active), prefixes received/advertised, and uptime. Logs and traffic logs do not provide live peer state.

Answer

Review the System log for BGP daemon errors.

Answer

Examine the Traffic log for BGP port 179 sessions.

Answer

Check the GlobalProtect gateway log.

Question 13

An administrator is troubleshooting a policy where applications are being identified incorrectly in Prisma Access. Which tool should be used to inspect how Prisma Access performs App-ID identification on a live stream of packets?

Accepted Answer

Examine the Traffic log session details to view the detected App-ID, or use packet captures if necessary.. To troubleshoot App-ID misidentification, you inspect the Traffic log session details, which show the detected application, the App-ID that was applied, and the reason for the identification (e.g., signature, port, decryption status). If more detail is needed, packet captures can be taken to see the actual traffic. This is the standard troubleshooting workflow for App-ID issues in Prisma Access.

Answer

Verify the SSL decryption certificate chain.

Answer

Check the GlobalProtect client configuration profile.

Answer

Review the Panorama Audit log.

Question 14

A Prisma Access mobile user experiences a scenario where specific internal domains fail to resolve when connected via GlobalProtect, while other internal domains resolve successfully. The split-DNS configuration in Panorama lists multiple domains. What is the most likely reason for this partial DNS failure?

Accepted Answer

Improperly formatted domain suffixes or exceeding the maximum number of supported split-DNS search domains for the client operating system.. Split-DNS in GlobalProtect allows administrators to specify which DNS suffixes should be resolved by internal DNS servers versus public DNS. Partial resolution failures typically occur when the configured domain suffixes are improperly formatted (e.g., missing leading dot, wrong syntax) or when the total number of split-DNS search domains exceeds the maximum supported by the client OS — Windows and macOS have limits on search domain list length. Domains beyond that limit are silently ignored, causing only some internal domains to resolve.

Answer

The GlobalProtect portal SSL certificate is expired.

Answer

WildFire cloud connectivity is down.

Answer

BGP route reflection is misconfigured on the Service Connection.

Question 15

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

Accepted Answer

Monitor > Logs > System or Authentication logs in Panorama.. RADIUS authentication failures and timeouts are logged in the System and Authentication logs in Panorama (Monitor > Logs). These logs capture the authentication request, response, and any timeout or communication errors with the RADIUS server. This is the correct place to diagnose the failure.

Answer

Policies > NAT.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > Threat.