Prisma Access Troubleshooting

An enterprise deployment of Prisma Access uses explicit proxy. Users report that authentication prompts appear repeatedly when browsing internal web applications. What is the most likely cause of this authentication looping in an explicit proxy setup?

An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?

A remote user reports that their GlobalProtect connection connects successfully to Prisma Access, but they cannot resolve internal fully qualified domain names (FQDNs). Where should the administrator check to ensure DNS server IP addresses are correctly pushed to the GlobalProtect client?

An administrator is troubleshooting a Prisma Access deployment experiencing intermittent packet drops and high latency across remote branches. Which THREE diagnostic steps or tools should be used? (Choose three)

Which TWO actions should an administrator take when troubleshooting high CPU utilization on Prisma Access cloud infrastructure nodes? (Choose two)

An administrator is investigating a security alert in Prisma Access triggered by an Anti-Spyware profile. Which log contains the detailed packet capture (pcap) or attack details for this specific event?

An administrator needs to verify whether a Prisma Access Remote Network is successfully exchanging routes with the customer CPE router over BGP. Where can the real-time BGP peer state be checked?

A Prisma Access engineer is troubleshooting an issue where users in a specific Remote Network location cannot authenticate against an on-premises LDAP server because the Service Connection is dropping packets. What is the recommended Panorama CLI command to test connectivity to the LDAP server through the Service Connection?

A security team reports that threat prevention signatures are not updating on Prisma Access nodes. Where in Panorama should the administrator verify the scheduling and status of dynamic updates for Prisma Access?

An administrator wants to check the status of active IPsec tunnels for a Prisma Access Remote Network location. Which Panorama menu path provides the most direct overview of IPsec tunnel health?

An enterprise network team is troubleshooting a Prisma Access Remote Network deployment where DNS queries from branch offices are failing to resolve internal resources. Which THREE components should be inspected? (Choose three)

Which TWO tools or logs in Panorama should an administrator use when troubleshooting a security policy rule that is unexpectedly dropping legitimate user traffic in Prisma Access? (Choose two)

An administrator wants to verify that threat prevention signatures are actively blocking simulated malicious traffic in a Prisma Access environment. Which testing tool or procedure is standard for verifying threat signatures safely?

A remote network user in a Prisma Access deployment is experiencing intermittent packet loss and slow application performance over the IPsec tunnel to the Remote Network (RN) node. Upon checking the system logs, the network engineer notices repetitive IKE rekey negotiations. Which troubleshooting step should be taken first to identify the root cause?

An administrator notices that a subset of mobile users connecting via GlobalProtect in Prisma Access cannot resolve internal corporate hostnames, while external websites load normally. The split-tunnel configuration includes the corporate domain. Where should the administrator check first in Panorama to troubleshoot this DNS resolution failure?

While troubleshooting a Prisma Access Remote Network deployment, an engineer notices that routes advertised via BGP from the customer's data center are not appearing in the Prisma Access routing table. Where can the engineer view BGP peer status and learned routes in Panorama?

An administrator needs to verify whether Host Information Profile (HIP) checks are failing for a specific mobile user attempting to connect to Prisma Access. Which log should the administrator review in Panorama?

An administrator wants to view historical bandwidth utilization trends for a specific Remote Network location over the past 30 days. Which Panorama monitoring workspace provides this historical reporting?

An administrator has deployed Prisma Access Remote Networks, but traffic from a branch office is failing to pass through the IPsec tunnel to Prisma Access. The IKE phase 1 negotiation is failing. Which Prisma Access operational command should the administrator run via the CLI to check the IPsec tunnel status and IKE SA parameters?

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

Which TWO actions should an administrator take to troubleshoot an authentication failure when mobile users attempt to log into Prisma Access using SAML? (Choose two)

A Prisma Access deployment has multiple Remote Networks and Mobile Users. An administrator implements Quality of Service (QoS) to prioritize VoIP traffic over bulk file transfers. After applying the QoS profile, VoIP performance does not improve. What should the administrator verify first in the Prisma Access QoS configuration?

An administrator is investigating intermittent authentication failures for remote users connecting via GlobalProtect to Prisma Access using SAML. Which THREE log sources or troubleshooting commands can assist in identifying the root cause? (Choose three)

When troubleshooting a Prisma Access deployment using SAML authentication, an administrator notices that users are successfully authenticated by the IdP, but the GlobalProtect client displays an error stating 'Invalid SAML Response: Signature Validation Failed'. What is the most likely root cause?

An organization notices that certain cloud-based SaaS applications are experiencing performance bottlenecks when accessed through Prisma Access mobile users. The administrator wants to configure explicit SaaS application traffic steering or bypass. Where is this configured in Panorama for Prisma Access?

An enterprise network administrator is troubleshooting an IPsec tunnel failure between a remote network and Prisma Access where Dead Peer Detection (DPD) keeps tearing down the tunnel. Which THREE potential causes should be investigated? (Choose three)

An administrator needs to verify the exact version of Prisma Access running on the cloud infrastructure. Where in Panorama is this version information displayed?

Which TWO actions should an administrator perform when troubleshooting User-ID mapping failures for mobile users in Prisma Access? (Choose two)

A remote network connected via Prisma Access is experiencing packet drops due to Maximum Transmission Unit (MTU) size mismatches. Which troubleshooting technique or configuration should be verified to resolve IP packet fragmentation issues?

Which TWO logs should an administrator check in Panorama when troubleshooting a mobile user who reports that their connection keeps dropping after a short period of time? (Choose two)

A Prisma Access mobile user experiences a scenario where specific internal domains fail to resolve when connected via GlobalProtect, while other internal domains resolve successfully. The split-DNS configuration in Panorama lists multiple domains. What is the most likely reason for this partial DNS failure?

An administrator implements a new Decryption policy in Prisma Access to inspect inbound traffic to a public-facing application hosted behind a Prisma Access Public IP. After deployment, users report receiving certificate warning errors. What should the administrator inspect first to resolve the warning?

A network engineer is configuring a new Remote Network in Prisma Access and needs to ensure that traffic from the branch office to the internet is breakout locally rather than backhauled to headquarters. How is local internet breakout verified in Prisma Access?

A Prisma Access deployment utilizes Service Connections to connect to a corporate data center. An administrator notices that traffic destined for internal data center subnets is being sent out to the internet instead of the Service Connection. What is the most likely cause of this routing misconfiguration?

Which TWO logs or monitoring views in Panorama are essential when troubleshooting a remote network user's inability to reach a specific cloud application via Prisma Access? (Choose two)

An administrator needs to review configuration changes made to Prisma Access settings in Panorama over the past week to determine who modified a security policy. Which log should the administrator examine?

Which TWO methods can an administrator use to monitor the health and operational status of Prisma Access Service Connections in Panorama? (Choose two)

A network engineer is troubleshooting why a specific security policy rule configured in Panorama is not matching traffic in a Prisma Access environment. Which Panorama testing tool simulates traffic against security rules to verify rule evaluation?

Which TWO configuration steps should an administrator verify when troubleshooting an issue where Panorama cannot push updates or configurations to Prisma Access nodes? (Choose two)

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

A security administrator needs to check real-time threat logs for a specific Prisma Access mobile user who reports being blocked from accessing a malicious file. Which Panorama menu path provides the most direct access to these logs?

Which TWO troubleshooting methods are effective when verifying whether Host Information Profile (HIP) checks are operating correctly for Prisma Access mobile users? (Choose two)

An administrator notices that users connecting via Prisma Access Remote Networks are unable to reach a specific internal application hosted in the corporate datacenter. The traffic is dropped by Prisma Access. Which tool in Panorama should the administrator use first to verify if the security policy is matching and blocking the traffic in real-time?

Which TWO commands or tools are recommended for troubleshooting routing issues on Prisma Access infrastructure? (Choose two)

An administrator needs to monitor the volume of traffic passing through a specific Prisma Access Service Connection. Which monitoring tool in Panorama displays aggregated data on bandwidth usage, top applications, and top users?

An enterprise deployment of Prisma Access utilizes Kerberos authentication for mobile users. Users report frequent authentication prompt failures when connecting via GlobalProtect from external networks. What is the most likely root cause of Kerberos authentication failure in this scenario?

An administrator troubleshooting a Prisma Access mobile user connectivity issue wants to verify whether the GlobalProtect gateway is actively responding to client connection requests. Where can this real-time session and gateway status be verified?

An administrator troubleshooting a Prisma Access Mobile Users deployment notices authentication failures for users authenticating via SAML to an external IdP. The users report being stuck in an authentication loop. Which log file on Panorama should the administrator examine to troubleshoot SAML response assertion issues?

An administrator is troubleshooting a Prisma Access environment where threat prevention profiles are failing to block known malicious file downloads. Which THREE settings or logs should the administrator investigate? (Choose three)

A security administrator is troubleshooting a URL Filtering policy in Prisma Access where users are able to access a category that should be blocked. Which tool in Panorama should the administrator use to test and verify which URL category a specific website falls under and which policy rule applies?

An administrator is troubleshooting a Prisma Access mobile user environment where users are unable to connect because of an invalid certificate error presented by the GlobalProtect Portal. Which configuration element in Panorama should be verified?

An administrator is troubleshooting a Prisma Access deployment where specific applications are identified as 'incomplete' or 'unknown-tcp' in the Traffic logs. Which THREE factors or troubleshooting steps should be evaluated? (Choose three)

An administrator is troubleshooting a Prisma Access mobile user issue where users connected via GlobalProtect cannot access local network printers or local subnet resources while connected to the VPN. Which THREE settings should be reviewed in Panorama? (Choose three)

Which TWO actions should an administrator take when troubleshooting an IPsec site-to-site tunnel failure between a customer CPE device and a Prisma Access Remote Network node? (Choose two)

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

An administrator needs to verify the license status and active subscriptions (such as WildFire, Threat Prevention, and URL Filtering) for Prisma Access in Panorama. Which menu path should be used?

An enterprise user reports that when connected to Prisma Access Mobile Users, certain internal applications load extremely slowly or fail to render images. Investigation reveals that packet fragmentation is occurring. Which Prisma Access setting should the administrator adjust to mitigate this fragmentation issue for mobile users?

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch office users cannot reach external websites. Which TWO configuration areas or logs should the administrator check to resolve this issue? (Choose two)

An administrator configures a Service Connection in Prisma Access to reach an on-premises Active Directory domain controller for authentication. Users are able to log in, but User-ID is failing to map IP addresses to usernames for users behind the Remote Network. What is the most likely reason for this User-ID failure?

Users in a specific region are experiencing intermittent latency and packet loss when accessing SaaS applications through Prisma Access. The administrator wants to analyze the quality of the path between the remote network location and the Prisma Access cloud node. Which Prisma Access feature should be utilized?

A network engineer is troubleshooting an IPsec site-to-site tunnel failure between a customer CPE and a Prisma Access Remote Network. The IKE phase 1 negotiations fail. Which log should the engineer examine to determine the exact reason for the IKE negotiation failure?

An enterprise has deployed Prisma Access with multiple remote networks and mobile users. An administrator notices that threat intelligence feeds (such as malicious IP lists and dynamic address groups) are not updating. Which THREE components should be inspected to resolve this update failure? (Choose three)

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

An organization notices that mobile users connecting to Prisma Access from a specific country are experiencing high latency and frequent disconnections. The administrator wants to check the regional Prisma Access node performance and status. Which feature in Panorama provides regional status and cloud infrastructure metrics?

An enterprise deployment of Prisma Access uses explicit proxy. Users report that specific SaaS applications are failing because the proxy is stripping required HTTP headers. Where should the administrator check and modify proxy header insertion rules in Prisma Access?

A network engineer is configuring Prisma Access and needs to verify the status of deployed Mobile User nodes across different regions. Which Panorama workspace is dedicated to displaying the overall health and status of Prisma Access infrastructure?

An organization uses SAML authentication with Prisma Access for mobile users. Users report an intermittent 'Authentication Failed' error when trying to establish a GlobalProtect connection. The Identity Provider (IdP) logs show successful authentication, but Prisma Access logs indicate a failure. What is the most likely cause of this discrepancy?

An administrator configures a new Service Connection in Prisma Access to allow mobile users to access resources in the corporate data center. However, traffic from mobile users cannot reach the data center. The administrator confirms that the IPsec tunnel is up. What is the most likely cause of this issue in Panorama?

An administrator troubleshooting a Prisma Access environment notices that specific traffic is bypassing security inspection. Upon checking the Security Policy, the administrator sees that a security rule has the profile setting set to 'None'. What does this configuration mean for traffic matching that rule?

When troubleshooting a Prisma Access deployment where traffic from remote users is failing Threat Prevention inspection, which TWO components or configurations must be verified? (Choose two)

When troubleshooting SSL Decryption issues in a Prisma Access environment where users report certificate warnings, which THREE areas should an administrator inspect? (Choose three)

An administrator is troubleshooting a Prisma Access explicit proxy deployment where users report that specific web applications are failing with connection timeout errors. Which THREE areas should the administrator check? (Choose three)

An administrator needs to troubleshoot a Security Policy rule that is expected to block access to unauthorized cloud storage applications in a Prisma Access environment. Where can the administrator view real-time data regarding which specific applications are being utilized by remote users?

An administrator notices that the Panorama management server is failing to push configuration updates to Prisma Access nodes. Where should the administrator check for configuration push failure details and error logs in Panorama?

An administrator is troubleshooting a Prisma Access mobile user deployment where GlobalProtect clients are unable to connect. Which THREE components or settings should the administrator inspect to resolve the connection failure? (Choose three)

An administrator is troubleshooting a policy where applications are being identified incorrectly in Prisma Access. Which tool should be used to inspect how Prisma Access performs App-ID identification on a live stream of packets?