SSE-Engineer Prisma Access Troubleshooting Practice Test 6 — 15 Questions

Question 1

An enterprise network team is troubleshooting a Prisma Access Remote Network deployment where DNS queries from branch offices are failing to resolve internal resources. Which THREE components should be inspected? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Service Connection routing configuration to ensure DNS traffic destined for internal DNS servers is correctly routed across the Service Connection tunnel.. Option A is correct because in a Prisma Access Remote Network deployment, DNS queries to internal servers must traverse the Service Connection tunnel, so the Service Connection routing configuration must include the internal DNS server subnets; otherwise queries are dropped or sent elsewhere. Option B is correct because Security Policy rules must explicitly permit DNS (UDP/TCP port 53) from the branch/Remote Network zone to the Service Connection or internal zones, and a missing or misordered rule will silently block resolution. Option E is correct because the Remote Network configuration in Panorama defines the DNS server IP addresses handed to branch clients; if the primary and secondary DNS server IPs are wrong or missing, clients cannot resolve internal resources. Option C is not relevant because the GlobalProtect client portal certificate affects user/endpoint connectivity and authentication, not branch Remote Network DNS forwarding. Option D is not relevant because WildFire is a threat prevention subscription for file analysis and does not influence DNS resolution for internal resources.

Answer

Verify the GlobalProtect client portal certificate.

Answer

Check the WildFire threat prevention subscription license key.

Question 2

An administrator is troubleshooting a Prisma Access explicit proxy deployment where users report that specific web applications are failing with connection timeout errors. Which THREE areas should the administrator check? (Choose three)

Accepted Answer

Inspect Proxy Authentication and Decryption profiles to ensure authentication challenges are correctly processed.. Option A is correct because in a Prisma Access explicit proxy deployment, Proxy Authentication and Decryption profiles determine how the firewall handles authentication challenges and SSL decryption; if these are misconfigured, the proxy may silently drop or fail to respond to the client's CONNECT/GET requests, producing connection timeouts. Option C is correct because Security Policy rules must explicitly permit traffic to the explicit proxy listener ports (for example, TCP 8080) on the Prisma Access proxy; if the policy denies or does not match that traffic, sessions time out before reaching the proxy service. Option D is correct because the explicit proxy port and proxy profile configured on Prisma Access must match the port and PAC file/browser settings on the client; a mismatch means the browser sends requests to a port the proxy is not listening on, resulting in connection timeouts. Option B is not relevant because BGP AS numbers apply to Service Connection routing and do not affect explicit proxy listener behavior or client proxy sessions. Option E is not relevant because GlobalProtect pre-logon timeout pertains to GlobalProtect remote access tunnels, not to explicit proxy web traffic.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Check the GlobalProtect client pre-logon timeout value.

Question 3

Which TWO configuration steps should an administrator verify when troubleshooting an issue where Panorama cannot push updates or configurations to Prisma Access nodes? (Choose two)

Accepted Answer

Check Panorama > Job Status to review specific error codes and failed configuration push tasks.. Option A is correct because Panorama > Job Status is the primary place to inspect configuration push jobs, their task IDs, and specific error codes when commits or pushes to Prisma Access fail, directly revealing why the push did not complete. Option B is correct because Panorama must maintain active cloud services communication and valid management certificates to authenticate to and reach the Prisma Access cloud infrastructure; broken connectivity or expired/invalid certificates will block pushes. Option C is not relevant because restarting a branch CPE device does not address Panorama-to-Prisma-Access push failures. Option D is incorrect because manually updating the URL Filtering database is unrelated to configuration or update push failures from Panorama. Option E is incorrect because modifying NAT policy on a remote firewall does not resolve Panorama's inability to push updates or configurations to Prisma Access nodes.

Answer

Restart the CPE device at the branch office.

Answer

Update the URL Filtering database manually.

Answer

Modify the NAT policy rules on the remote firewall.

Question 4

Which TWO logs should an administrator check in Panorama when troubleshooting a mobile user who reports that their connection keeps dropping after a short period of time? (Choose two)

Accepted Answer

Monitor > Logs > Traffic to check for session timeouts, TCP resets, or security policy drops.. Option A is correct because Monitor > Logs > Traffic in Panorama records session details such as session end reasons, TCP resets, and security policy drops, which can reveal whether the mobile user's connection is being torn down by a timeout, reset, or deny rule. Option C is correct because Monitor > Logs > GlobalProtect captures GlobalProtect client connection events, gateway reconnects, and error messages, which directly show why a mobile user's tunnel keeps dropping after a short period. Option B is not appropriate here because Monitor > Logs > Threat shows security threat detections, not the connection-drop events described. Option D is not appropriate because Panorama > Cloud Services > Audit Log records cloud service and configuration audit activity, not user tunnel connectivity. Option E is not appropriate because Monitor > Logs > Data Filtering pertains to data filtering profile matches, not GlobalProtect connection stability.

Answer

Monitor > Logs > Threat.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > Data Filtering.

Question 5

An administrator is troubleshooting a Prisma Access deployment where specific applications are identified as 'incomplete' or 'unknown-tcp' in the Traffic logs. Which THREE factors or troubleshooting steps should be evaluated? (Choose three)

Accepted Answer

Check for asymmetrical routing where traffic enters through one Prisma Access node/tunnel but exits through another.. Option C is correct because Prisma Access App-ID requires that both directions of a flow traverse the same node/tunnel; asymmetrical routing causes the firewall to see only half the session, so the application cannot be identified and shows as incomplete or unknown-tcp. Option D is correct because App-ID needs to observe the full TCP three-way handshake and subsequent application data; if packet captures show the session is reset or terminated before the handshake completes, the firewall never gets enough context to classify the application. Option E is correct because overly restrictive security rules or service objects that drop traffic before App-ID has inspected sufficient packets will prevent identification, leaving the session logged as incomplete or unknown-tcp. Option A is not relevant because the GlobalProtect gateway SSL certificate expiration affects user connectivity and authentication, not application identification in Traffic logs. Option B is not relevant because WildFire license status governs file submission and verdicts, not the App-ID classification of TCP sessions.

Answer

Verify the expiration date of the GlobalProtect gateway SSL certificate.

Answer

Check the WildFire subscription license key status.

Question 6

Which TWO troubleshooting methods are effective when verifying whether Host Information Profile (HIP) checks are operating correctly for Prisma Access mobile users? (Choose two)

Accepted Answer

Check GlobalProtect client settings in Panorama to ensure HIP report generation and submission intervals are correctly configured.. Option C is correct because HIP checks on Prisma Access mobile users depend on the GlobalProtect client generating and submitting HIP reports, and those behaviors are governed by the HIP report generation and submission interval settings configured in the GlobalProtect agent settings in Panorama; verifying these settings confirms the client is actually sending HIP data for evaluation. Option D is correct because the Monitor > Logs > HIP Match log records the results of HIP-based compliance evaluations, showing which HIP profiles matched or failed for each user/device, which is the direct way to verify that HIP checks are operating correctly. Option A is incorrect because NAT policy rules only affect address translation and have no bearing on HIP report generation or evaluation. Option B is incorrect because restarting a physical branch firewall is irrelevant to Prisma Access mobile user HIP checks, which are enforced in the Prisma Access cloud infrastructure. Option E is incorrect because updating the URL Filtering database affects web content inspection, not HIP check functionality.

Answer

Modify the NAT policy rules.

Answer

Restart the physical branch firewall.

Answer

Update the URL Filtering database.

Question 7

Which TWO actions should an administrator take when troubleshooting high CPU utilization on Prisma Access cloud infrastructure nodes? (Choose two)

Accepted Answer

Check ACC and Traffic/Threat logs to identify traffic spikes, unusual session volumes, or potential security attacks.. Option A is correct because Prisma Access high CPU on cloud infrastructure nodes is frequently caused by traffic surges, session exhaustion, or attack traffic, and the ACC plus Traffic/Threat logs in Panorama provide the visibility needed to correlate CPU spikes with specific applications, users, session counts, or threat signatures. Option C is correct because generating a Tech Support File for Prisma Access from Panorama captures the cloud node's system resource data, running processes, and daemon status, which is the standard evidence-gathering step for diagnosing which process (for example, the dataplane or management daemon) is consuming CPU. Option B is not relevant because changing the GlobalProtect portal authentication profile affects user login behavior, not cloud node CPU consumption. Option D is not relevant because updating the Antivirus dynamic signature version is a content update action and does not address the root cause of high CPU on infrastructure nodes. Option E is not relevant because restarting a branch customer CPE device affects the remote site's connectivity and would not resolve CPU load on Prisma Access cloud infrastructure nodes.

Answer

Modify the GlobalProtect client portal authentication profile.

Answer

Update the Antivirus dynamic signature version.

Answer

Restart the customer CPE device at the branch location.

Question 8

An enterprise network administrator is troubleshooting an IPsec tunnel failure between a remote network and Prisma Access where Dead Peer Detection (DPD) keeps tearing down the tunnel. Which THREE potential causes should be investigated? (Choose three)

Accepted Answer

Mismatched DPD interval and retry timer settings between the customer CPE and the Prisma Access node.. Option B is correct because DPD relies on matching timers: if the customer CPE's DPD interval/retry values differ from those configured on the Prisma Access IKE gateway, one side may declare the peer dead before the other responds, tearing down the IPsec tunnel. Option C is correct because DPD probes are carried as IKEv2 informational messages over UDP 500/4500 (or ICMP-based keepalives in some designs), so any intermediate firewall, NAT device, or ISP that drops or rate-limits those packets will cause false peer-death detection and tunnel teardown. Option E is correct because DPD is timeout-based: sustained packet loss or extreme latency on the transport path can delay or lose the DPD probes/acknowledgements so the retry timer expires, triggering the tunnel to be torn down even though the peer is actually alive. Option A is not relevant because GlobalProtect client licensing on Panorama has no bearing on site-to-site IPsec DPD behavior, and Option D is not relevant because WildFire is a file-analysis subscription and does not affect IKE/DPD keepalive processing.

Answer

The GlobalProtect client software license is expired on Panorama.

Answer

WildFire cloud analysis subscription has lapsed.

Question 9

An administrator notices that users connecting via Prisma Access Remote Networks are unable to reach a specific internal application hosted in the corporate datacenter. The traffic is dropped by Prisma Access. Which tool in Panorama should the administrator use first to verify if the security policy is matching and blocking the traffic in real-time?

Accepted Answer

Traffic Logs with a filter for the source user and destination IP, checking the 'Drop Reason' field.. Traffic Logs in Panorama are the authoritative source for confirming whether a session was allowed or denied by security policy, and the 'Drop Reason' field explicitly identifies policy-based drops (e.g., 'policy-deny', 'rule match'). Filtering by source user and destination IP isolates the specific flow in question and shows the matching rule in real time. This directly answers whether the security policy is the cause of the drop.

Answer

GlobalProtect app diagnostics tab on the endpoint.

Answer

Prisma Access Insight path quality monitoring.

Answer

Panorama Dynamic Updates status page.

Question 10

A remote user reports that their GlobalProtect connection connects successfully to Prisma Access, but they cannot resolve internal fully qualified domain names (FQDNs). Where should the administrator check to ensure DNS server IP addresses are correctly pushed to the GlobalProtect client?

Accepted Answer

Panorama > Prisma Access > Setup > Portal > Agent > Client Settings.. DNS server IP addresses pushed to GlobalProtect clients are configured in the Client Settings section of the GlobalProtect Portal agent configuration, which is managed under Panorama > Prisma Access > Setup > Portal > Agent > Client Settings. This is where administrators define the DNS servers, split-tunnel DNS domains, and other network settings that the portal pushes to the GlobalProtect app. If internal FQDNs cannot be resolved, the DNS server list in this configuration is the first place to verify.

Answer

Prisma Access > Cloud Services > Status.

Answer

Panorama > Managed Devices > Remote Networks.

Answer

Panorama > Policy > Security.

Question 11

An administrator has deployed Prisma Access Remote Networks, but traffic from a branch office is failing to pass through the IPsec tunnel to Prisma Access. The IKE phase 1 negotiation is failing. Which Prisma Access operational command should the administrator run via the CLI to check the IPsec tunnel status and IKE SA parameters?

Accepted Answer

show vpn ike-sa gateway . On Palo Alto Networks firewalls and Prisma Access, the operational command 'show vpn ike-sa gateway ' displays IKE phase 1 security associations, including negotiation state, peer identity, and any failure reason. This is the correct CLI command to diagnose IKE phase 1 failures for a remote network IPsec tunnel.

Answer

show globalprotect-gateway current-users

Answer

show system info

Answer

show running resource-monitor

Question 12

An administrator configures a new Service Connection in Prisma Access to allow mobile users to access resources in the corporate data center. However, traffic from mobile users cannot reach the data center. The administrator confirms that the IPsec tunnel is up. What is the most likely cause of this issue in Panorama?

Accepted Answer

The internal subnet routes associated with the Service Connection have not been added to the Mobile Users Explicit Proxy or Split Tunnel configuration.. For mobile users to reach data center resources via a Service Connection, the internal subnet routes must be included in the Mobile Users configuration—either in the split tunnel or explicit proxy settings—so that traffic is directed through the Service Connection. Without these routes, mobile user traffic will not be forwarded to the data center even if the IPsec tunnel is up.

Answer

Panorama requires a reboot to activate Service Connections.

Answer

The GlobalProtect client version is outdated on all endpoints.

Answer

The WildFire public cloud subscription has expired.

Question 13

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch office users cannot reach external websites. Which TWO configuration areas or logs should the administrator check to resolve this issue? (Choose two)

Accepted Answer

Panorama > Policy > Security rules allowing trust-to-untrust traffic. Option B is correct because in a Prisma Access Remote Networks deployment, security policy is managed centrally through Panorama, and a missing or misconfigured trust-to-untrust security rule will silently drop branch user traffic destined for the internet, so verifying the rulebase is essential. Option D is correct because Remote Networks connectivity depends on the routing configuration pushed from Panorama, including static routes or BGP peering with the Prisma Access service connection; if routes are missing or the BGP session is down, branch traffic never reaches the internet. Option A is incorrect because Insight mobile user license allocation applies to Mobile Users (GlobalProtect) licensing, not Remote Networks branch traffic. Option C is incorrect because the GlobalProtect Portal client certificate store is relevant to Mobile Users authentication, not to Remote Networks site-to-site tunnels. Option E is incorrect because the WildFire analysis report queue concerns threat analysis results and has no bearing on basic internet reachability for branch users.

Answer

Prisma Access Insight mobile user license allocation

Answer

GlobalProtect Portal client certificate store

Answer

WildFire analysis report queue

Question 14

When troubleshooting a Prisma Access deployment where traffic from remote users is failing Threat Prevention inspection, which TWO components or configurations must be verified? (Choose two)

Accepted Answer

Decryption policy configuration ensuring traffic is not bypassing inspection. Option A is correct because if a Decryption policy (SSL Forward Proxy) is not configured or the traffic is excluded from decryption, encrypted sessions bypass content inspection and Threat Prevention profiles cannot evaluate the payload, so the decryption policy must be verified to ensure traffic is not bypassing inspection. Option D is correct because Threat Prevention inspection only occurs when the matching Security Policy rule has the appropriate Threat Prevention profiles attached — Antivirus, Vulnerability Protection, and Anti-Spyware — so the rule must be checked to confirm these profiles are applied to the user traffic. Option B is not relevant because CASB API connector tokens relate to SaaS application visibility and data loss prevention via API-based out-of-band scanning, not inline Threat Prevention inspection of remote user traffic. Option C is not relevant because the username-to-IP mapping agent affects user identification and policy matching, not the Threat Prevention inspection pipeline itself. Option E is not relevant because Service Connection BGP keepalive intervals affect routing adjacency stability between Prisma Access and on-premises/service connections, not Threat Prevention inspection of remote user traffic.

Answer

Cloud Access Security Broker (CASB) API connector tokens

Answer

GlobalProtect user username-to-IP mapping agent status

Answer

Service Connection BGP peer keepalive intervals

Question 15

Users in a specific region are experiencing intermittent latency and packet loss when accessing SaaS applications through Prisma Access. The administrator wants to analyze the quality of the path between the remote network location and the Prisma Access cloud node. Which Prisma Access feature should be utilized?

Accepted Answer

Prisma Access Insight path quality monitoring. Prisma Access Insight path quality monitoring provides detailed metrics on the quality of the path between remote network locations and Prisma Access cloud nodes, including latency, packet loss, and jitter. This is the correct feature to analyze the quality of the path for troubleshooting intermittent latency and packet loss.

Answer

Panorama ACC Threat Map

Answer

Traffic log bandwidth utilization graphs

Answer

GlobalProtect internal adapter diagnostics