SSE-Engineer Prisma Access Troubleshooting Practice Question
When troubleshooting SSL Decryption issues in a Prisma Access environment where users report certificate warnings, which THREE areas should an administrator inspect? (Choose three)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the Decryption Policy rules to ensure the correct traffic zones, URLs, and actions (Decrypt/No Decrypt) are configured.
Decryption troubleshooting requires verifying certificate trust chains, forwarding/inbound profile settings, and explicit proxy/decryption policy bindings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the Decryption Policy rules to ensure the correct traffic zones, URLs, and actions (Decrypt/No Decrypt) are configured.
Why this is correct
Incorrectly matched decryption rules can cause improper interception or un-trusted certificate presentation.
- ✗
Verify the BGP routing table for Service Connection prefixes.
Why it's wrong here
BGP routing controls IP packet forwarding, not TLS/SSL cryptographic certificate validation.
- ✓
Inspect Inbound Decryption rule server certificates and private keys to ensure proper binding.
Why this is correct
Inbound decryption requires the exact server private key and certificate loaded in Panorama.
- ✗
Check the GlobalProtect client version installed on mobile workstations.
Why it's wrong here
GlobalProtect client versions do not directly govern SSL decryption certificate validation warnings.
- ✓
Verify that the Forward Trust and Forward Untrust certificates installed in Prisma Access are signed by the organization's internal Enterprise CA and trusted by endpoints.
Why this is correct
If endpoints do not trust the CA that signs re-issued certificates during SSL forward proxy, browsers throw certificate warnings.
About these practice questions
This SSE-Engineer question is part of Courseiva's 203-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This SSE-Engineer practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSE-Engineer exam.