SSE-Engineer Prisma Access Troubleshooting Practice Test 8 — 15 Questions

Question 1

A Prisma Access administrator notices that a mobile user's traffic to a sanctioned SaaS application is being routed through a Service Connection in a different region than expected, causing high latency. The administrator wants to verify which Service Connection the user's session is currently using for that application. Which action should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Traffic logs in the Prisma Access Insights or the Strata Logging Service for the session details.. Traffic logs in Prisma Access Insights or Strata Logging Service include detailed session information, including the Service Connection used for egress. By filtering logs for the specific user and application, the administrator can see exactly which Service Connection is handling the traffic. This directly answers the question and enables troubleshooting latency issues related to regional egress selection.

Answer

Use the Prisma Access CLI command 'show service-connection status' to display active connections.

Answer

Review the GlobalProtect app logs on the user's endpoint for the selected gateway and service connection.

Answer

Run a traceroute from the user's endpoint to the SaaS application to see the path.

Question 2

A Prisma Access administrator is troubleshooting why a mobile user's traffic is not being inspected for threats. The administrator suspects that the security policy rule is not applying the correct security profiles. Which Prisma Access component should the administrator examine to confirm that the security profiles are attached to the rule?

Accepted Answer

The security policy rule in the Prisma Access policy configuration.. Security profiles are applied through security policy rules. To ensure threat inspection, the administrator must verify that the rule matching the user's traffic has the correct profiles attached. The GlobalProtect portal, decryption policy, and service connection are not where profiles are configured. Checking the security policy rule directly confirms whether inspection is enabled for that traffic.

Answer

The GlobalProtect portal configuration.

Answer

The service connection configuration.

Answer

The decryption policy rules.

Question 3

Users connected through a Prisma Access remote network report that traffic to a partner's public web application is being blocked, while the same application works from a mobile user tunnel. The administrator confirms a URL Filtering profile is applied to both the remote network and mobile user policies. Which log type and filter should the administrator use to determine why the remote network traffic is blocked?

Accepted Answer

URL Filtering logs filtered by the remote network users and the partner destination, to identify the matched category and action.. A URL Filtering block is captured in URL Filtering logs, which record the category, matched profile, and action. Since mobile users succeed and remote network users fail, the discrepancy lies in whichever URL Filtering profile applies to the remote network path. Filtering URL logs by those users and the partner destination surfaces the exact category and rule responsible.

Answer

Traffic logs filtered by the remote network source and destination, to check whether the session is allowed or denied at the firewall stage.

Answer

Data Filtering logs filtered by the application and the file direction to identify the blocked transfer.

Answer

Authentication logs filtered by the remote network users to confirm group mapping succeeded.

Question 4

A Prisma Access administrator is troubleshooting a remote network site where IPsec tunnels are flapping. The administrator suspects that the tunnel monitoring settings are too aggressive. Which configuration parameter should be adjusted to reduce flapping?

Accepted Answer

Adjust the dead peer detection (DPD) interval and retry count on the remote network IPSec tunnel.. Tunnel flapping in remote network IPsec tunnels is often caused by overly aggressive dead peer detection (DPD) settings. If DPD intervals are too short or retry counts too low, temporary network latency or packet loss can trigger tunnel teardown and re-establishment. Adjusting these parameters to be more lenient allows the tunnel to withstand transient issues, reducing flapping. This is the targeted solution for the described scenario.

Answer

Enable IKEv1 instead of IKEv2 for the remote network IPSec tunnel.

Answer

Modify the IPsec proposal encryption algorithms to use stronger ciphers.

Answer

Increase the IKEv2 rekey timer on the remote network IPSec tunnel.

Question 5

An administrator is troubleshooting a Prisma Access mobile user who reports that DNS resolution for internal domains fails intermittently. The user is connected via GlobalProtect, and the internal DNS servers are reachable. The administrator suspects that DNS queries are being sent to the wrong DNS server due to split-tunnel configuration. Which log source should the administrator check to see which DNS server the client is using for internal queries?

Accepted Answer

GlobalProtect app logs on the endpoint. GlobalProtect app logs on the endpoint are the best source to verify which DNS servers the client is using. They record the DNS settings received from the gateway, including split-DNS domains and the corresponding DNS servers. By examining these logs, the administrator can confirm whether internal domains are being resolved by the correct internal DNS server or if they are incorrectly sent to an external DNS server.

Answer

System logs on the Prisma Access portal

Answer

HIP match logs in the Prisma Access gateway

Answer

Traffic logs filtered by DNS application

Question 6

An administrator is troubleshooting a Prisma Access deployment where mobile users report slow performance when accessing SaaS applications. The administrator suspects that traffic is being backhauled through a service connection instead of going directly to the internet. Which Prisma Access feature should the administrator verify to ensure that traffic is taking the optimal path?

Accepted Answer

Local breakout. Local breakout is designed to optimize mobile user internet access by egressing traffic at the nearest Prisma Access location. If it is not enabled, traffic may be backhauled to a service connection, adding latency. Verifying local breakout settings ensures that SaaS traffic takes the optimal path. Other features like HIP, decryption, and QoS do not control traffic routing and are not relevant to the backhauling concern.

Answer

HIP-based policy

Answer

SSL decryption

Answer

Quality of Service (QoS)

Question 7

A Prisma Access administrator is troubleshooting a Service Connection that repeatedly flaps, causing intermittent loss of access to internal applications for both mobile users and remote networks. The IPsec tunnel to the data center establishes but drops within minutes. Which TWO items should the administrator verify to isolate the cause? (Choose two.)

Accepted Answer

Confirm that the IKE and IPsec proposals on both peers match exactly, including encryption, hash, and DH group settings.. A tunnel that establishes then drops within minutes typically points to phase 2 negotiation or timing issues. Mismatched IKE or IPsec proposals fail at rekey, and incompatible dead peer detection or lifetime timers cause premature teardown. Verifying both parameter sets on each peer isolates the cause and stabilizes the Service Connection for all dependent users.

Answer

Verify that the GlobalProtect portal certificate chain is valid and not expired.

Answer

Confirm that URL Filtering profiles are attached to the remote network security policy.

Answer

Review the number of HIP profiles assigned to mobile users to reduce tunnel load.

Question 8

A Prisma Access administrator is troubleshooting a mobile user who cannot access an internal application after a successful GlobalProtect connection. The administrator suspects that the issue is related to the split tunnel configuration. Which action should the administrator take to verify whether the application's subnet is included in the split tunnel?

Accepted Answer

Check the GlobalProtect app logs on the user's endpoint for tunnel routes.. Split tunnel configuration in GlobalProtect determines which traffic is routed through the VPN tunnel and which goes directly to the internet. When a user cannot reach an internal application, it is often because the application's subnet is not included in the split tunnel access routes. The most reliable way to verify this is to inspect the GlobalProtect app logs on the endpoint, which record the routes added to the routing table. This confirms whether the subnet is correctly tunneled.

Answer

Run a traceroute from the user's endpoint to the internal application.

Answer

Check the HIP profile match for the user in Prisma Access.

Answer

Review the Prisma Access system logs for split tunnel errors.

Question 9

A Prisma Access administrator is troubleshooting a remote network deployment where users experience intermittent connectivity failures. The administrator notices that the IPsec tunnel frequently flaps. Which component should the administrator check to determine if the tunnel is being renegotiated due to mismatched proposal settings?

Accepted Answer

The IKE and IPsec crypto profiles on both the branch CPE and the Prisma Access service connection.. Intermittent IPsec tunnel flaps are typically caused by mismatched crypto profiles or proposal settings. The IKE and IPsec crypto profiles must align on both the branch CPE and the Prisma Access service connection. Verifying these profiles ensures that the tunnel parameters match, preventing renegotiation failures. GlobalProtect portal, security policies, and DNS proxy settings do not impact tunnel negotiation and are not relevant to this issue.

Answer

The security policy rules applied to the remote network traffic.

Answer

The DNS proxy settings on the service connection.

Answer

The GlobalProtect portal configuration for mobile users.

Question 10

An administrator is troubleshooting a Prisma Access deployment where mobile users authenticated through SAML intermittently lose access to internal resources after about an hour, though the GlobalProtect tunnel never drops. Reviewing logs shows the users still have valid tunnel sessions and assigned IP addresses. Which underlying condition is most likely causing the intermittent access loss?

Accepted Answer

The SAML identity provider group mapping or session timeout is expiring, causing user-to-group mappings to be lost.. Access that fails roughly hourly while the tunnel and address stay valid points to identity rather than network state. SAML group mappings and identity provider sessions have finite lifetimes; when they expire, group-based policy no longer matches and internal access is denied. Refreshing group mapping or extending session lifetime restores the missing identity context.

Answer

The Service Connection IPsec tunnel is rekeying every hour and briefly dropping internal routes.

Answer

The GlobalProtect gateway is load-balancing users across multiple gateways and reassigning addresses mid-session.

Answer

The decryption policy is re-evaluating certificates hourly and blocking re-established sessions.

Question 11

An SSE engineer is investigating why a Prisma Access mobile user's traffic to a SaaS application is being inspected by a decryption policy that should be bypassed. The decryption policy has a source user group that should exclude this user, and the user is a member of a different group. The engineer confirms the user's group membership in the identity provider is correct. Which factor is most likely causing the decryption policy to match unexpectedly?

Accepted Answer

The user's group membership has not yet been synchronized to Prisma Access, so the policy evaluates an outdated or empty group mapping.. Unexpected decryption matches on group-based policies usually stem from identity information being out of date in Prisma Access. If the user's group mapping has not synchronized, the policy evaluates against stale or missing data and can match a rule that should have been excluded, applying decryption where a bypass was intended.

Answer

The decryption policy is evaluated before user identification, so group-based conditions are ignored during the first session.

Answer

The decryption profile assigned to the policy is misconfigured, causing the policy to apply to all users regardless of group conditions.

Answer

SSL decryption bypass rules take precedence only when the destination is in a predefined category, not when a source user group is used.

Question 12

A Prisma Access engineer is troubleshooting a Service Connection that is not establishing. The engineer suspects that the issue is related to the Service Connection configuration or network reachability. Which two actions should the engineer perform to validate the Service Connection status and connectivity? (Choose two.)

Accepted Answer

Verify that the Service Connection is enabled and that the correct IPsec tunnel settings are configured in the Prisma Access portal.. To validate a Service Connection that is not establishing, the engineer should first verify that it is enabled and correctly configured in the Prisma Access portal. This ensures that the necessary parameters are in place. Second, checking the Service Connection status in the dashboard provides immediate feedback on whether the connection is up or down, and often includes error details. These two actions are the quickest way to confirm the state and identify misconfigurations.

Answer

Run a packet capture on the branch firewall to analyze IPsec traffic.

Answer

Check the IKE and IPsec logs on the branch firewall for any negotiation failures.

Answer

Verify that the branch firewall has a route to the Prisma Access Service IP addresses.

Question 13

An administrator is troubleshooting a Prisma Access remote network where IPsec tunnel status shows up, but traffic from the branch is intermittently dropped when it exceeds a certain throughput. The branch has a single ISP link with 500 Mbps capacity and the tunnel is configured with default settings. Which cause should the administrator investigate first?

Accepted Answer

The IPsec tunnel is hitting bandwidth or packet-per-second limits tied to the selected compute location or license, causing drops above the threshold.. When an IPsec tunnel stays up but traffic drops above a certain throughput, the most likely cause is a capacity limit on the Prisma Access side, such as the compute location's bandwidth or the licensed throughput for remote networks. Verifying the location capacity and license tier is the correct first step before blaming the ISP or encryption settings.

Answer

The tunnel MTU is too low, causing fragmentation that only manifests when throughput increases.

Answer

The IPsec proposal is using a cipher that cannot sustain more than a fixed number of packets per second on the branch device.

Answer

The branch ISP is applying traffic shaping that only affects IPsec-encapsulated packets above 500 Mbps.

Question 14

A Prisma Access administrator is troubleshooting a mobile user who reports that they can connect via GlobalProtect but cannot access any internal resources. The administrator suspects that the issue is related to the user's group mapping. Which log type in Prisma Access should the administrator review to verify user-to-group mapping?

Accepted Answer

User-ID logs. User-to-group mapping in Prisma Access is handled by User-ID, which collects user information from directory services and maps users to groups. When a user cannot access internal resources despite a successful GlobalProtect connection, it is often because the user's group membership is not correctly recognized, causing group-based security policies to fail. The User-ID logs provide detailed information about user mapping events, including group associations, making them the correct logs to review.

Answer

Threat logs

Answer

GlobalProtect logs

Answer

Traffic logs

Question 15

A Prisma Access administrator needs to verify that the GlobalProtect portal is presenting the correct certificate to mobile users during authentication. Which tool should the administrator use to inspect the certificate presented by the portal?

Accepted Answer

Use the 'openssl s_client' command from a client machine to connect to the portal and view the certificate.. The 'openssl s_client' command connects to the portal's HTTPS port and displays the certificate chain, allowing the administrator to verify the exact certificate presented. This is a direct and reliable method to inspect the certificate, ensuring it matches the expected configuration. Other methods may show cached or different certificates, leading to confusion.

Answer

Check the GlobalProtect app logs on a client to see the certificate details.

Answer

Use a browser to navigate to the portal and click on the padlock icon to view the certificate.

Answer

Run 'show global-protect-portal certificate' from the Prisma Access CLI.