SSE-Engineer Prisma Access Troubleshooting Practice Test 5 — 15 Questions

Question 1

A Prisma Access deployment has multiple Remote Networks and Mobile Users. An administrator implements Quality of Service (QoS) to prioritize VoIP traffic over bulk file transfers. After applying the QoS profile, VoIP performance does not improve. What should the administrator verify first in the Prisma Access QoS configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the QoS profile is applied to the correct security policy rules and that the guaranteed bandwidth settings align with the provisioned Prisma Access node bandwidth limits.. QoS in Prisma Access only takes effect if the QoS profile is attached to the correct security policy rules and the guaranteed bandwidth settings are within the provisioned node bandwidth. If the profile isn't applied to the VoIP-matching rules or the bandwidth guarantees exceed node capacity, prioritization won't occur. Verifying this alignment is the first logical troubleshooting step.

Answer

Verify the BGP AS number on the customer CPE.

Answer

Check the expiration date of the GlobalProtect gateway SSL certificate.

Answer

Ensure that GlobalProtect pre-logon mode is disabled.

Question 2

An administrator needs to verify the exact version of Prisma Access running on the cloud infrastructure. Where in Panorama is this version information displayed?

Accepted Answer

Panorama > Cloud Services > Setup > Infrastructure / Status.. Prisma Access infrastructure version information is displayed under Panorama > Cloud Services > Setup > Infrastructure / Status, where the cloud service plugin shows the current Prisma Access version, tenant status, and component versions. This is the authoritative location for verifying the running cloud infrastructure version.

Answer

Policies > Security.

Answer

Device > Certificates.

Answer

Monitor > Dynamic Updates.

Question 3

An enterprise deployment of Prisma Access utilizes Kerberos authentication for mobile users. Users report frequent authentication prompt failures when connecting via GlobalProtect from external networks. What is the most likely root cause of Kerberos authentication failure in this scenario?

Accepted Answer

Lack of direct network line-of-sight or routing from the mobile user's remote location to the internal Active Directory Domain Controllers via a Service Connection.. Kerberos requires the client to reach a Key Distribution Center (KDC) — typically an internal Active Directory Domain Controller — to obtain a Ticket Granting Ticket. A mobile user on an external network has no direct line-of-sight to internal DCs unless Prisma Access provides a Service Connection with routing to those DCs. Without that path, the Kerberos exchange cannot complete, causing authentication prompt failures.

Answer

WildFire cloud subscription has expired.

Answer

The decryption policy is missing an inbound rule.

Answer

The GlobalProtect client software license is invalid.

Question 4

An administrator wants to verify that threat prevention signatures are actively blocking simulated malicious traffic in a Prisma Access environment. Which testing tool or procedure is standard for verifying threat signatures safely?

Accepted Answer

Use standardized test payloads or URLs (such as the EICAR string for antivirus or PANW test URLs) and check the Threat log.. Using standardized test payloads like the EICAR string for antivirus or PANW-provided test URLs is the safe, standard method to verify that threat prevention signatures are actively blocking malicious traffic. These tests generate benign traffic that matches known signatures, and the results appear in the Threat log, confirming enforcement without causing harm.

Answer

Perform a Denial of Service attack against the Prisma Access public IP.

Answer

Disable SSL decryption across all security rules.

Answer

Restart the Panorama management server.

Question 5

A network engineer is troubleshooting an IPsec site-to-site tunnel failure between a customer CPE and a Prisma Access Remote Network. The IKE phase 1 negotiations fail. Which log should the engineer examine to determine the exact reason for the IKE negotiation failure?

Accepted Answer

Monitor > Logs > System (filtering for IKE or IPsec events) or viewing tunnel status.. System logs and IKE/IPsec operational debugging logs record Phase 1 and Phase 2 negotiation mismatches.

Answer

Monitor > Logs > Threat.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > URL Filtering.

Question 6

An administrator troubleshooting a Prisma Access environment notices that specific traffic is bypassing security inspection. Upon checking the Security Policy, the administrator sees that a security rule has the profile setting set to 'None'. What does this configuration mean for traffic matching that rule?

Accepted Answer

Traffic allowed by the rule will not be inspected by Antivirus, Anti-Spyware, Vulnerability Protection, or WildFire security profiles.. When a security rule in Prisma Access has its security profile setting configured as 'None', the rule still permits the traffic based on its match criteria, but no security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, WildFire, URL Filtering, etc.) are applied to that traffic. This effectively creates an allow rule with zero content inspection, which is why the administrator observed traffic bypassing security inspection. The action of the rule is still 'Allow' — 'None' only refers to the profile group attached, not the rule action.

Answer

Traffic matching the rule is dropped automatically.

Answer

SSL decryption is automatically enabled.

Answer

Traffic is forced through the explicit proxy.

Question 7

Which TWO actions should an administrator take when troubleshooting an IPsec site-to-site tunnel failure between a customer CPE device and a Prisma Access Remote Network node? (Choose two)

Accepted Answer

Verify that IKE Phase 1 and Phase 2 proposal parameters (encryption, authentication, Diffie-Hellman groups) match between the CPE and Prisma Access node.. Option C is correct because an IPsec site-to-site tunnel requires the IKE Phase 1 (ISAKMP) and Phase 2 (IPsec) proposals to be identical on both peers, including encryption algorithms (e.g., AES-256), authentication/hash (e.g., SHA-256), Diffie-Hellman groups (e.g., group 14), and lifetimes; any mismatch in these parameters causes the IKE negotiation to fail before the tunnel establishes. Option E is correct because Panorama collects the Prisma Access Remote Network node's System logs and operational IKE/IPsec logs, which record the exact negotiation failure reason (e.g., NO_PROPOSAL_CHOSEN, INVALID_KE_PAYLOAD, or phase-1/phase-2 mismatch), allowing the administrator to pinpoint the fault. Option A is not relevant because the mobile user SAML authentication profile applies to GlobalProtect user authentication, not to the IKE pre-shared-key or certificate authentication used by a site-to-site tunnel. Option B is not appropriate because disabling security policy rules does not affect IKE/IPsec tunnel establishment and would unnecessarily remove enforcement across all remote locations. Option D is not relevant because the GlobalProtect agent runs on remote user endpoints and has no role in a CPE-to-Prisma Access Remote Network IPsec tunnel.

Answer

Reconfigure the mobile user SAML authentication profile.

Answer

Disable all security policy rules across all remote locations.

Answer

Restart the GlobalProtect agent on all remote user endpoints.

Question 8

An administrator is troubleshooting a Prisma Access mobile user deployment where GlobalProtect clients are unable to connect. Which THREE components or settings should the administrator inspect to resolve the connection failure? (Choose three)

Accepted Answer

Inspect the GlobalProtect Client Settings in Panorama to ensure gateways and agent configurations are correctly assigned.. Option A is correct because the GlobalProtect Client Settings in Panorama determine which portals and gateways are pushed to the agent, and misassigned or missing gateway/agent configurations will prevent clients from connecting. Option B is correct because the portal and gateway present SSL/TLS certificates during the connection handshake; if these certificates are expired, have an untrusted chain, or use a hostname not matching the certificate, clients will reject the connection. Option E is correct because the Authentication Profile governs how users authenticate (RADIUS, LDAP, or SAML); if those servers are unreachable or not responding, the portal or gateway authentication step fails and the client cannot establish a session. Option C is not relevant because the WildFire file size upload limit affects threat inspection of file uploads, not GlobalProtect client connectivity. Option D is not relevant because the BGP AS number on a data center router pertains to routing peering with Prisma Access, not to mobile user GlobalProtect tunnel establishment.

Answer

Check the WildFire file size upload limit for malicious attachments.

Answer

Verify the BGP AS number configured on the customer data center router.

Question 9

Which TWO tools or logs in Panorama should an administrator use when troubleshooting a security policy rule that is unexpectedly dropping legitimate user traffic in Prisma Access? (Choose two)

Accepted Answer

Monitor > Logs > Traffic to identify sessions marked with a 'deny' action and note the matching rule name.. Option A is correct because Monitor > Logs > Traffic in Panorama shows the traffic log entries for Prisma Access sessions, including the Action field (allow/deny/drop) and the Rule Name that matched, which directly identifies which security policy rule is unexpectedly denying legitimate user traffic. Option C is correct because the CLI command 'test security-policy-match' (run on the firewall or Prisma Access node) simulates a flow with specified source, destination, user, application, and service, then reports which security rule would match and the resulting action, letting the administrator verify rule evaluation order and confirm why the traffic is being dropped. Option B is incorrect because Device > High Availability status only reports HA peer state and synchronization, not security policy rule matching. Option D is incorrect because Monitor > Dynamic Updates > Status shows content, antivirus, and app/threat signature update versions, not policy rule decisions. Option E is incorrect because Panorama > Cloud Services > Audit Log records administrative and configuration change activity, not live traffic policy enforcement decisions.

Answer

Device > High Availability status.

Answer

Monitor > Dynamic Updates > Status.

Answer

Panorama > Cloud Services > Audit Log.

Question 10

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Accepted Answer

Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.. Option A is correct because BGP peering requires the AS numbers to be properly configured: for eBGP the local and remote AS must differ and match each side's configured peer AS, while for iBGP both peers must use the same AS, so a mismatch prevents the session from establishing and routes from being learned. Option B is correct because even with an established session, Prisma Access will not learn any prefixes unless the CPE actually advertises them via BGP network or redistribute statements, so confirming the advertised prefixes is essential. Option D is correct because the BGP peer IP configured on Prisma Access must exactly match the CPE's BGP source/peer address (and vice versa) for the TCP session on port 179 to form; a mismatch means no peering and no route exchange. Option C is not relevant because WildFire cloud analysis is a threat-detection subscription and has no bearing on BGP route learning. Option E is not relevant because GlobalProtect portal SSL certificate expiration affects remote-user VPN authentication, not Remote Network BGP peering.

Answer

Verify the WildFire cloud analysis subscription status.

Answer

Check the GlobalProtect portal SSL certificate expiration date.

Question 11

Which TWO actions should an administrator perform when troubleshooting User-ID mapping failures for mobile users in Prisma Access? (Choose two)

Accepted Answer

Verify that GlobalProtect is configured to report user mappings and check authentication log status.. Option A is correct because User-ID mapping for mobile users in Prisma Access depends on GlobalProtect reporting user mappings to the User-ID service; the administrator must confirm GlobalProtect is configured to send those mappings and review authentication logs to see whether authentication succeeded or failed. Option E is correct because the CLI command 'show user ip-user-mapping all' displays the current user-to-IP mappings on the firewall, allowing the administrator to verify whether active mappings are actually populated. Options B, C, and D are not relevant: restarting branch firewall hardware, changing WildFire signature update schedules, and modifying QoS bandwidth profiles do not address User-ID mapping or authentication reporting for mobile users.

Answer

Restart the physical firewall hardware in the branch office.

Answer

Change the WildFire signature update schedule.

Answer

Modify the QoS bandwidth allocation profile.

Question 12

Which TWO logs or monitoring views in Panorama are essential when troubleshooting a remote network user's inability to reach a specific cloud application via Prisma Access? (Choose two)

Accepted Answer

Monitor > ACC (Application Command Center) to analyze application traffic behavior and usage trends.. Option C is correct because Monitor > ACC (Application Command Center) in Panorama aggregates Prisma Access traffic and provides application-level visibility, letting you analyze whether the specific cloud application's traffic is being seen, how it is being categorized, and usage/behavior trends that reveal policy or App-ID mismatches. Option E is correct because Monitor > Logs > Traffic shows the actual session detail for Prisma Access traffic, including whether the flow was allowed, denied, or timed out, along with the matching security policy, source/destination, and application, which is essential to pinpoint where the remote user's connection fails. Option A is not appropriate because the Cloud Services Audit Log records administrative and configuration change events in the Prisma Access cloud service, not end-user application traffic. Option B is not appropriate because Device > Setup > Management is a configuration area for Panorama management settings, not a log or monitoring view. Option D is not appropriate because Objects > Addresses is an address object configuration page, not a troubleshooting log or monitoring view.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Device > Setup > Management.

Answer

Objects > Addresses.

Question 13

An administrator is troubleshooting a Prisma Access environment where threat prevention profiles are failing to block known malicious file downloads. Which THREE settings or logs should the administrator investigate? (Choose three)

Accepted Answer

Check the Threat and WildFire logs to see if the files were inspected, logged, or bypassed due to exclusions.. Option A is correct because the Threat and WildFire logs are the authoritative place to confirm whether a file was actually inspected, merely logged, or bypassed by a decryption exclusion or application override, which directly explains why malicious downloads are not being blocked. Option B is correct because SSL/TLS-encrypted payloads cannot be matched against antivirus or WildFire signatures unless SSL Decryption (forward proxy or inbound inspection) is applied to that traffic, so undecrypted sessions will silently pass malware. Option E is correct because a threat prevention profile only takes effect when the Anti-Spyware, Antivirus, and WildFire Analysis profiles are attached to the Security Policy rule that matches the traffic; if the rule references no profile or the wrong profile, files are never blocked. Option C is not relevant because the BGP AS number on the Remote Network CPE only affects routing and tunnel establishment, not content inspection or file blocking. Option D is not relevant because the GlobalProtect Portal client timeout governs how long a client can remain disconnected before re-authentication, and has no bearing on threat prevention or file inspection.

Answer

Check the BGP AS number on the Remote Network CPE.

Answer

Verify the GlobalProtect Portal client timeout setting.

Question 14

An administrator is troubleshooting a Prisma Access deployment experiencing intermittent packet drops and high latency across remote branches. Which THREE diagnostic steps or tools should be used? (Choose three)

Accepted Answer

Check IPsec tunnel monitoring statistics and DPD settings for packet loss and tunnel flapping.. Option B is correct because intermittent drops and high latency across remote branches in a Prisma Access deployment are frequently caused by IPsec tunnel instability, so examining tunnel monitoring statistics and Dead Peer Detection (DPD) settings helps identify packet loss, rekey failures, and tunnel flapping. Option D is correct because MTU and TCP MSS clamping mismatches on IPsec tunnels cause fragmentation or dropped oversized packets, which directly produces intermittent packet loss and latency symptoms that must be verified and corrected. Option E is correct because QoS bandwidth allocation and utilization review reveals whether congestion is dropping or delaying critical traffic, a common cause of high latency and drops on branch links. Option A does not belong because modifying Panorama administrator accounts is an administrative access change unrelated to packet forwarding, latency, or tunnel performance. Option C does not belong because GlobalProtect portal certificate expiration would cause authentication or connection failures for remote users, not the intermittent packet drops and latency described in the scenario.

Answer

Modify the administrative administrator accounts in Panorama.

Answer

Check the GlobalProtect portal certificate expiration date.

Question 15

Which TWO actions should an administrator take to troubleshoot an authentication failure when mobile users attempt to log into Prisma Access using SAML? (Choose two)

Accepted Answer

Verify that the SAML Identity Provider (IdP) signing certificate imported into Panorama matches the active IdP certificate.. Option D is correct because SAML assertions are validated against the IdP signing certificate imported into Panorama; if that certificate does not match the certificate the IdP is actively using to sign assertions, signature validation fails and authentication is rejected. Option E is correct because SAML assertions contain NotBefore and NotOnOrAfter conditions, so significant clock skew between the IdP and the Prisma Access service nodes causes valid assertions to be treated as expired or not yet valid, breaking login. Option A is wrong because NAT policy rules affect address translation and routing, not SAML assertion validation. Option B is wrong because URL Filtering categories govern web access policy, not the SAML authentication exchange with the IdP. Option C is wrong because restarting a branch firewall does not address SAML trust, certificate, or time-synchronization problems on the Prisma Access side.

Answer

Modify the NAT policy rules.

Answer

Check the URL Filtering category for the IdP login domain.

Answer

Restart the physical firewall in the branch office.