SSE-Engineer Quick Quiz — 10 Questions

Question 1

An administrator is configuring a Prisma Access Service Connection for a data center that hosts both production and development workloads. The security team requires that mobile users accessing development subnets be inspected by a different security policy than those accessing production subnets, without deploying separate Service Connections. Which approach should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use destination-based security policy rules that reference the production and development subnets as separate destination addresses. Prisma Access security policy rules can match on destination addresses, so the administrator can write separate rules for production and development subnets. This provides distinct inspection and enforcement for each workload type while reusing a single Service Connection, meeting the requirement without adding tunnels or on-premises changes.

Answer

Configure policy-based forwarding on the Service Connection

Answer

Create separate Service Connections for production and development subnets

Answer

Apply different decryption profiles to the Service Connection tunnel

Question 2

An organization requires that all DNS queries from Prisma Access mobile users be inspected and filtered for malicious domains before resolving. Where in Panorama is Prisma Access DNS Security configured?

Accepted Answer

Objects -> Security Profiles -> DNS Security. DNS Security profiles are attached to Security Policy rules in Panorama to inspect and take action on DNS requests.

Answer

Policies -> NAT

Answer

Panorama -> Cloud Services -> GlobalProtect -> DNS

Answer

Network Services -> DNS Proxy

Question 3

An enterprise using Prisma Access Mobile Users needs to enforce Host Information Profile (HIP) checks to ensure that endpoints have an active and updated corporate antimalware solution before granting access to internal applications. Which workflow must an administrator complete to successfully enforce this requirement?

Accepted Answer

Create HIP Objects and HIP Profiles in Panorama, then reference those profiles in Security Policy rules.. HIP enforcement in Prisma Access requires creating HIP Objects (which define the check, e.g., antimalware presence/version) and HIP Profiles (which combine objects into a logical condition), then referencing the HIP profile in Security Policy rules. This is the standard Panorama workflow for endpoint compliance gating. Without the profile referenced in policy, HIP data is collected but not enforced.

Answer

Deploy a Prisma Access Service Connection to proxy endpoint security telemetry to Panorama.

Answer

Configure the Cloud Identity Engine to query local endpoint registries directly for antimalware signatures.

Answer

Enable User-ID syslog mapping to ingest antimalware status logs from third-party endpoint protection servers.

Question 4

An administrator notices that certain SaaS applications are not being accurately identified or controlled by Prisma Access CASB inline policies due to domain fronting and complex URL structures. Which feature should the administrator configure in Prisma Access to ensure deep application identification and decryption of this traffic?

Accepted Answer

SSL Decryption policy with a Forward Trust certificate. To accurately identify and control SaaS applications that use domain fronting and complex URL structures, the administrator must enable SSL Decryption with a Forward Trust certificate. Decryption allows the firewall to see the actual SNI and HTTP Host header, enabling the CASB inline policy to correctly identify the application and apply controls. Without decryption, domain fronting hides the true destination.

Answer

Quality of Service (QoS) profile for SaaS acceleration

Answer

User-ID agent mapping via LDAP integration

Answer

DNS Security with external recursive resolver redirection

Question 5

A Prisma Access mobile user connects successfully via GlobalProtect but cannot reach any internal applications hosted behind a Service Connection. The administrator confirms the Service Connection status is green and the user's HIP profile is compliant. Which log source should the administrator check first to verify that the user's traffic is being routed through the expected Service Connection?

Accepted Answer

Traffic logs filtered by the user and destination. Traffic logs are the authoritative source for verifying session-level routing in Prisma Access. They include fields such as source user, destination, and the Service Connection or egress interface used. By filtering on the mobile user and the internal application IP, the administrator can see whether the traffic is being sent through the expected Service Connection or being dropped, which directly diagnoses the issue.

Answer

GlobalProtect App logs on the endpoint

Answer

HIP match logs in the Prisma Access gateway

Answer

System logs on the Prisma Access portal

Question 6

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

Accepted Answer

Configure Group Mapping Settings in Panorama to retrieve user group memberships from the Cloud Identity Engine.. Option B is correct because, to enforce group-based policy in Prisma Access, Panorama must have Group Mapping Settings that point to the Cloud Identity Engine as the directory source so it can resolve user-to-group memberships for policy matching. Option D is correct because an Authentication Profile in Panorama must reference the Cloud Identity Engine container so that user authentication requests are validated against the CIE directory service, enabling User-ID to associate authenticated users with their groups. Option A is incorrect because disabling MFA is not required and would weaken security; MFA can coexist with CIE-based authentication. Option C is incorrect because installing GlobalProtect on domain controllers is unnecessary and inappropriate; CIE connects to directory services via APIs/connectors, not by running the agent on domain controllers. Option E is incorrect because manual CSV uploads are not part of CIE integration and do not provide the real-time group mapping that CIE delivers.

Answer

Disable all multi-factor authentication (MFA) requirements on Prisma Access portals.

Answer

Install the GlobalProtect agent directly on all domain controller servers acting as CIE proxies.

Answer

Manually export user CSV files daily and upload them to Panorama using the CLI.

Question 7

An administrator is troubleshooting a Prisma Access mobile user who reports that DNS resolution for internal domains fails intermittently. The user is connected via GlobalProtect, and the internal DNS servers are reachable. The administrator suspects that DNS queries are being sent to the wrong DNS server due to split-tunnel configuration. Which log source should the administrator check to see which DNS server the client is using for internal queries?

Accepted Answer

GlobalProtect app logs on the endpoint. GlobalProtect app logs on the endpoint are the best source to verify which DNS servers the client is using. They record the DNS settings received from the gateway, including split-DNS domains and the corresponding DNS servers. By examining these logs, the administrator can confirm whether internal domains are being resolved by the correct internal DNS server or if they are incorrectly sent to an external DNS server.

Answer

System logs on the Prisma Access portal

Answer

HIP match logs in the Prisma Access gateway

Answer

Traffic logs filtered by DNS application

Question 8

An administrator is reviewing the status of a Prisma Access deployment using Prisma Access Insights. Which THREE key metrics or insights can be viewed through this tool? (Choose three)

Accepted Answer

Service health and status of cloud infrastructure and tunnels. Prisma Access Insights provides visibility into service health, license utilization, active user counts, and bandwidth consumption across locations.

Answer

Individual endpoint user Windows registry configurations

Answer

Local branch switch port VLAN configurations

Question 9

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

Accepted Answer

Monitor > Logs > System or Authentication logs in Panorama.. RADIUS authentication failures and timeouts are logged in the System and Authentication logs in Panorama (Monitor > Logs). These logs capture the authentication request, response, and any timeout or communication errors with the RADIUS server. This is the correct place to diagnose the failure.

Answer

Policies > NAT.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > Threat.

Question 10

An administrator is configuring a Service Connection in Prisma Access and wants to ensure that traffic from remote networks to on-premises resources is routed correctly. The on-premises network uses BGP with a private AS number. Which configuration must be applied on the Prisma Access side to establish BGP peering?

Accepted Answer

Enable BGP on the Service Connection and specify the peer AS and peer IP address.. For BGP peering over a Service Connection, you must enable BGP and provide the peer AS and peer IP address. This allows dynamic route exchange with the on-premises router, which uses a private AS number. Prisma Access supports BGP over Service Connections, and this configuration ensures proper routing and failover for traffic destined to on-premises resources.

Answer

Configure a static route to the on-premises network.

Answer

Set up an IPSec tunnel with BGP over it.

Answer

Configure OSPF on the Service Connection.