SSE-Engineer Prisma Access Troubleshooting Practice Test 7 — 15 Questions

Question 1

A Prisma Access administrator is troubleshooting a Remote Network deployment where branch users cannot reach internal applications hosted in a data center connected via an IPsec tunnel. The administrator confirms that the Remote Network IPsec tunnel is up and that the branch firewall routes the internal subnets toward Prisma Access. Which action should the administrator take next to verify that Prisma Access is correctly routing traffic to the data center?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the Prisma Access Service Connection status and verify the associated static routes for the data center subnets are present and active.. The Service Connection is the component that links Prisma Access to the data center. If the Service Connection is down or lacks the necessary static routes, Remote Network users cannot reach internal applications even though their IPsec tunnel is up. Verifying the Service Connection status and its routes is the logical next step to isolate the routing failure.

Answer

Verify that the branch firewall's IPsec tunnel interface is configured with the correct tunnel monitoring IP address.

Answer

Inspect the SSL Decryption profile applied to the Remote Network to ensure it is not blocking the internal application traffic.

Answer

Check the GlobalProtect app logs on the branch users' endpoints to confirm they are receiving the correct internal DNS servers.

Question 2

A Prisma Access administrator is troubleshooting a mobile user who reports that after connecting via GlobalProtect, they cannot access internal web servers by hostname, but can access them by IP address. Other mobile users in the same region do not have this issue. Which component should the administrator verify first?

Accepted Answer

The DNS server configuration in the GlobalProtect portal agent configuration for the user's region.. The ability to reach internal servers by IP but not by hostname indicates a DNS resolution problem. In Prisma Access, DNS settings for mobile users are pushed via the GlobalProtect portal agent configuration. If the DNS servers for the user's region are misconfigured or missing, the user cannot resolve internal hostnames. Verifying the DNS server configuration is the correct first step.

Answer

The SSL decryption policy applied to the user's traffic to ensure it is not blocking DNS queries.

Answer

The security policy rules that allow or deny traffic from the mobile user to the internal web servers.

Answer

The GlobalProtect app logs on the user's endpoint to check for HIP failures.

Question 3

A Prisma Access mobile user connects successfully via GlobalProtect but cannot reach any internal applications hosted behind a Service Connection. The administrator confirms the Service Connection status is green and the user's HIP profile is compliant. Which log source should the administrator check first to verify that the user's traffic is being routed through the expected Service Connection?

Accepted Answer

Traffic logs filtered by the user and destination. Traffic logs are the authoritative source for verifying session-level routing in Prisma Access. They include fields such as source user, destination, and the Service Connection or egress interface used. By filtering on the mobile user and the internal application IP, the administrator can see whether the traffic is being sent through the expected Service Connection or being dropped, which directly diagnoses the issue.

Answer

GlobalProtect App logs on the endpoint

Answer

HIP match logs in the Prisma Access gateway

Answer

System logs on the Prisma Access portal

Question 4

A Prisma Access administrator is troubleshooting an issue where mobile users intermittently lose access to all applications for a few seconds. The administrator suspects an issue with the GlobalProtect tunnel. Which tool should the administrator use to view the tunnel status and identify flapping?

Accepted Answer

The GlobalProtect app logs on the user's endpoint, looking for tunnel disconnect and reconnect events.. Intermittent loss of all applications for a few seconds suggests the GlobalProtect tunnel is flapping. The GlobalProtect app logs on the endpoint record tunnel state changes, including disconnects and reconnects. These logs provide the necessary detail to confirm flapping and identify patterns, such as timeouts or network changes. Other tools lack the per-user tunnel state history.

Answer

The Prisma Access system logs, filtering for GlobalProtect gateway events.

Answer

The Prisma Access dashboard's GlobalProtect status page, checking the number of connected users.

Answer

The traffic logs, filtering for denied sessions from the mobile user's IP address.

Question 5

A security administrator is troubleshooting a Prisma Access mobile user who cannot access an internal application hosted in a branch office. The user is connected via GlobalProtect and can reach the internet. The administrator has verified that the user's security policy allows the traffic. Which step should the administrator take next to diagnose the issue?

Accepted Answer

Review the Service Connection status and routing to ensure that the branch office network is reachable from Prisma Access.. Mobile users accessing internal applications require Prisma Access to route traffic to the branch office network. This is achieved through Service Connections or remote network tunnels. If the Service Connection is down or the branch office network is not advertised, traffic will fail. Verifying Service Connection status and routing ensures that Prisma Access can forward traffic to the correct destination, which is essential before investigating client-side issues.

Answer

Verify that the internal application's IP address is included in the mobile user's split tunnel configuration.

Answer

Check the GlobalProtect app logs on the user's device for tunnel errors.

Answer

Confirm that the user's device has the correct DNS servers configured to resolve the internal application's hostname.

Question 6

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch users experience slow throughput to SaaS applications. The IPsec tunnel to Prisma Access is up, but performance is degraded. The administrator suspects that traffic is not being forwarded to the optimal Service Connection. Which action should the administrator take to verify that Prisma Access is selecting the correct egress point for the branch?

Accepted Answer

Examine the traffic logs for the session and check the egress interface field. Traffic logs are the primary tool for verifying egress selection in Prisma Access. The egress interface field in the traffic log indicates the Service Connection used for a given session. For Remote Networks, administrators can filter logs by source IP and destination to see whether traffic egresses through the intended Service Connection, confirming optimal routing.

Answer

Check the GlobalProtect gateway selection logs on the portal

Answer

Review the IPsec tunnel statistics on the branch firewall

Answer

Run a traceroute from the branch firewall to the SaaS application

Question 7

A Prisma Access administrator needs to verify that a specific mobile user's traffic is being inspected by the correct security policy rule. The administrator wants to see the rule name that allowed or denied a recent session. Which log type should the administrator consult?

Accepted Answer

Traffic logs. Traffic logs are the only log type that records the security policy rule name and action for each session. By filtering traffic logs for the specific user and session, the administrator can identify the exact rule that allowed or denied the traffic. Other log types serve different purposes and do not contain policy rule information.

Answer

URL Filtering logs

Answer

Threat logs

Answer

System logs

Question 8

An administrator is troubleshooting a Prisma Access deployment where mobile users are unable to access certain SaaS applications. The users are connected via GlobalProtect, and the administrator has confirmed that the GlobalProtect tunnel is up. The administrator suspects that the issue is related to SSL decryption. Which action should the administrator take to verify that SSL decryption is functioning correctly?

Accepted Answer

Check the SSL Decryption logs in the Prisma Access dashboard for errors related to the SaaS applications.. SSL Decryption logs are the primary source for troubleshooting decryption issues. They record why decryption succeeded or failed, including certificate errors, unsupported protocols, or policy mismatches. When users cannot access SaaS applications and the tunnel is up, checking these logs can quickly reveal if decryption is failing and why. This allows the administrator to pinpoint whether the issue is due to decryption configuration, certificates, or other factors.

Answer

Ensure that the decryption policy includes the SaaS applications in the decryption profile.

Answer

Verify that the forward trust certificate is installed on the mobile users' devices.

Answer

Confirm that the SaaS applications are not excluded from decryption in the decryption policy.

Question 9

A Prisma Access administrator is troubleshooting a Remote Network deployment where branch users cannot reach internal applications hosted in a data center connected via an IPsec tunnel. The administrator confirms that the Remote Network IPsec tunnel is up and that the branch firewall routes the internal subnets toward Prisma Access. Which action should the administrator take next to verify that Prisma Access is correctly routing traffic to the data center?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the decryption logs to see if the session appears. To confirm SSL decryption is applied to a specific session, the administrator should check both traffic logs and decryption logs. The traffic log's 'Decrypted' flag indicates whether the session was decrypted, while decryption logs provide detailed records of decrypted sessions, including the policy matched. Together, they verify that decryption occurred and can help identify why a security policy may not have blocked the traffic.

Answer

Check the system logs for decryption-related events

Answer

Examine the GlobalProtect app logs on the user's endpoint for SSL errors

Answer

Use the Prisma Access CLI to run 'show session all' for the user

Question 10

A Prisma Access administrator notices that a specific remote network tunnel shows as up, but the branch users cannot reach any internet destinations. The tunnel interface on the branch CPE is up, and the administrator can ping the Prisma Access service IP. Which log type on the Prisma Access side should the administrator review first to determine whether traffic is being dropped by a security policy?

Accepted Answer

Traffic logs. When a remote network tunnel is up but users cannot reach the internet, the immediate suspicion is a security policy misconfiguration or a routing issue. Traffic logs on Prisma Access capture session-level details, including the applied security rule and action. Reviewing them will show if traffic is being denied and by which rule, enabling quick remediation. System, threat, and HIP logs do not provide this policy enforcement visibility for remote network traffic.

Answer

System logs

Answer

HIP Match logs

Answer

Threat logs

Question 11

An administrator is troubleshooting a Prisma Access mobile user who reports that corporate applications are unreachable, yet public websites load normally. In the Prisma Access status dashboard, the user's GlobalProtect connection shows Connected and the tunnel is assigned a 10.201.x.x address, but the Service Connection to the corporate data center shows a status of Down. Which action should the administrator take to resolve the user's issue?

Accepted Answer

Verify the Service Connection IPsec tunnel to the data center and bring the connection back up, since internal traffic depends on it.. Internal corporate reachability for mobile users depends on the Service Connection between Prisma Access and the data center. A healthy GlobalProtect tunnel with working internet access but failed internal access points to that backend path. Confirming and restoring the Service Connection IPsec tunnel re-establishes routing to internal subnets, which is the correct remediation for this symptom.

Answer

Reassign the user to a different GlobalProtect gateway with lower latency to restore internal access.

Answer

Renew the GlobalProtect user certificate on the portal and have the user reconnect.

Answer

Add the internal application subnets to the GlobalProtect split-tunnel include list so they route through the tunnel.

Question 12

A network administrator is troubleshooting a Prisma Access remote network deployment where users at a branch office are experiencing slow access to cloud applications. The administrator has verified that the IPsec tunnel is up and that there is no packet loss on the tunnel. Which tool should the administrator use to monitor the performance and latency of the Service Connection?

Accepted Answer

Prisma Access Dashboard's Service Connection health metrics. The Prisma Access Dashboard's Service Connection health metrics are specifically designed to monitor the performance of Service Connections, including latency, jitter, and packet loss. When remote network users experience slow access to cloud applications despite a healthy IPsec tunnel, the bottleneck may be at the Service Connection. Using the dashboard metrics allows the administrator to quickly assess if the Service Connection is experiencing degraded performance.

Answer

Panorama's Managed Devices health monitor

Answer

CLI commands on the remote network firewall to check tunnel statistics

Answer

GlobalProtect app logs on the branch office users' devices

Question 13

A Prisma Access engineer is troubleshooting a mobile user who cannot access an internal application after successfully connecting via GlobalProtect. The engineer suspects that the issue is related to the split-tunnel configuration. Which TWO actions should the engineer take to verify that the correct routes are being pushed to the client? (Choose two.)

Accepted Answer

Review the GlobalProtect agent logs on the user's endpoint for the received route table.. To diagnose split-tunnel routing issues for a mobile user, the engineer must confirm both the intended configuration and the actual client behavior. The gateway configuration defines which routes should be pushed, while the client logs show which routes were received. If either is missing the internal subnet, the user cannot access the application. These two actions together isolate whether the problem is in the configuration or in the client's application of the routes.

Answer

Run a packet capture on the Prisma Access service connection to see if traffic arrives.

Answer

Verify the user's authentication and group mapping in the Prisma Access directory sync.

Answer

Inspect the IPsec tunnel status between the service connection and the remote network.

Question 14

A Prisma Access administrator is investigating why a specific mobile user is unable to access a web application that is allowed by a security policy. The administrator suspects that the user is being blocked by a URL Filtering profile. Which log type should the administrator check first to confirm the block?

Accepted Answer

URL Filtering logs. URL Filtering logs are the correct logs to check because they contain the URL category, the action taken, and the profile that matched. This directly confirms whether a URL Filtering profile blocked the user's access. Other log types do not provide this specific information.

Answer

Data Filtering logs

Answer

Threat logs

Answer

Traffic logs

Question 15

A help desk technician reports that a Prisma Access mobile user cannot reach any resources, and the GlobalProtect client displays 'Portal unreachable' before the user even authenticates. The administrator confirms the user's internet connectivity is fine and other users at the same site are connected successfully. Which troubleshooting step should the administrator perform first?

Accepted Answer

Verify the portal FQDN resolves correctly from the client and that the required portal ports are reachable.. The error appears before authentication, so the failing stage is the client's initial HTTPS connection to the portal. Since peers at the same site succeed, the fault is local to this client, most likely DNS resolution of the portal FQDN or a blocked port. Verifying resolution and port reachability targets that first connection stage.

Answer

Check the user's HIP profile match against the HIP-enabled security policy.

Answer

Examine the user's decryption policy to see whether the portal certificate is being intercepted.

Answer

Restart the Service Connection to refresh the data center IPsec tunnel.