SSE-Engineer Practice Questions

Question 1

An administrator is configuring a Prisma Access Service Connection for a data center that hosts both production and development workloads. The security team requires that mobile users accessing development subnets be inspected by a different security policy than those accessing production subnets, without deploying separate Service Connections. Which approach should the administrator take?

Accepted Answer

Use destination-based security policy rules that reference the production and development subnets as separate destination addresses. Prisma Access security policy rules can match on destination addresses, so the administrator can write separate rules for production and development subnets. This provides distinct inspection and enforcement for each workload type while reusing a single Service Connection, meeting the requirement without adding tunnels or on-premises changes.

Answer

Configure policy-based forwarding on the Service Connection

Answer

Create separate Service Connections for production and development subnets

Answer

Apply different decryption profiles to the Service Connection tunnel

Question 2

An organization requires that all DNS queries from Prisma Access mobile users be inspected and filtered for malicious domains before resolving. Where in Panorama is Prisma Access DNS Security configured?

Accepted Answer

Objects -> Security Profiles -> DNS Security. DNS Security profiles are attached to Security Policy rules in Panorama to inspect and take action on DNS requests.

Answer

Policies -> NAT

Answer

Panorama -> Cloud Services -> GlobalProtect -> DNS

Answer

Network Services -> DNS Proxy

Question 3

An enterprise using Prisma Access Mobile Users needs to enforce Host Information Profile (HIP) checks to ensure that endpoints have an active and updated corporate antimalware solution before granting access to internal applications. Which workflow must an administrator complete to successfully enforce this requirement?

Accepted Answer

Create HIP Objects and HIP Profiles in Panorama, then reference those profiles in Security Policy rules.. HIP enforcement in Prisma Access requires creating HIP Objects (which define the check, e.g., antimalware presence/version) and HIP Profiles (which combine objects into a logical condition), then referencing the HIP profile in Security Policy rules. This is the standard Panorama workflow for endpoint compliance gating. Without the profile referenced in policy, HIP data is collected but not enforced.

Answer

Deploy a Prisma Access Service Connection to proxy endpoint security telemetry to Panorama.

Answer

Configure the Cloud Identity Engine to query local endpoint registries directly for antimalware signatures.

Answer

Enable User-ID syslog mapping to ingest antimalware status logs from third-party endpoint protection servers.

Question 4

An administrator notices that certain SaaS applications are not being accurately identified or controlled by Prisma Access CASB inline policies due to domain fronting and complex URL structures. Which feature should the administrator configure in Prisma Access to ensure deep application identification and decryption of this traffic?

Accepted Answer

SSL Decryption policy with a Forward Trust certificate. To accurately identify and control SaaS applications that use domain fronting and complex URL structures, the administrator must enable SSL Decryption with a Forward Trust certificate. Decryption allows the firewall to see the actual SNI and HTTP Host header, enabling the CASB inline policy to correctly identify the application and apply controls. Without decryption, domain fronting hides the true destination.

Answer

Quality of Service (QoS) profile for SaaS acceleration

Answer

User-ID agent mapping via LDAP integration

Answer

DNS Security with external recursive resolver redirection

Question 5

A Prisma Access mobile user connects successfully via GlobalProtect but cannot reach any internal applications hosted behind a Service Connection. The administrator confirms the Service Connection status is green and the user's HIP profile is compliant. Which log source should the administrator check first to verify that the user's traffic is being routed through the expected Service Connection?

Accepted Answer

Traffic logs filtered by the user and destination. Traffic logs are the authoritative source for verifying session-level routing in Prisma Access. They include fields such as source user, destination, and the Service Connection or egress interface used. By filtering on the mobile user and the internal application IP, the administrator can see whether the traffic is being sent through the expected Service Connection or being dropped, which directly diagnoses the issue.

Answer

GlobalProtect App logs on the endpoint

Answer

HIP match logs in the Prisma Access gateway

Answer

System logs on the Prisma Access portal

Question 6

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

Accepted Answer

Configure Group Mapping Settings in Panorama to retrieve user group memberships from the Cloud Identity Engine.. Option B is correct because, to enforce group-based policy in Prisma Access, Panorama must have Group Mapping Settings that point to the Cloud Identity Engine as the directory source so it can resolve user-to-group memberships for policy matching. Option D is correct because an Authentication Profile in Panorama must reference the Cloud Identity Engine container so that user authentication requests are validated against the CIE directory service, enabling User-ID to associate authenticated users with their groups. Option A is incorrect because disabling MFA is not required and would weaken security; MFA can coexist with CIE-based authentication. Option C is incorrect because installing GlobalProtect on domain controllers is unnecessary and inappropriate; CIE connects to directory services via APIs/connectors, not by running the agent on domain controllers. Option E is incorrect because manual CSV uploads are not part of CIE integration and do not provide the real-time group mapping that CIE delivers.

Answer

Disable all multi-factor authentication (MFA) requirements on Prisma Access portals.

Answer

Install the GlobalProtect agent directly on all domain controller servers acting as CIE proxies.

Answer

Manually export user CSV files daily and upload them to Panorama using the CLI.

Question 7

An administrator is troubleshooting a Prisma Access mobile user who reports that DNS resolution for internal domains fails intermittently. The user is connected via GlobalProtect, and the internal DNS servers are reachable. The administrator suspects that DNS queries are being sent to the wrong DNS server due to split-tunnel configuration. Which log source should the administrator check to see which DNS server the client is using for internal queries?

Accepted Answer

GlobalProtect app logs on the endpoint. GlobalProtect app logs on the endpoint are the best source to verify which DNS servers the client is using. They record the DNS settings received from the gateway, including split-DNS domains and the corresponding DNS servers. By examining these logs, the administrator can confirm whether internal domains are being resolved by the correct internal DNS server or if they are incorrectly sent to an external DNS server.

Answer

System logs on the Prisma Access portal

Answer

HIP match logs in the Prisma Access gateway

Answer

Traffic logs filtered by DNS application

Question 8

An administrator is reviewing the status of a Prisma Access deployment using Prisma Access Insights. Which THREE key metrics or insights can be viewed through this tool? (Choose three)

Accepted Answer

Service health and status of cloud infrastructure and tunnels. Prisma Access Insights provides visibility into service health, license utilization, active user counts, and bandwidth consumption across locations.

Answer

Individual endpoint user Windows registry configurations

Answer

Local branch switch port VLAN configurations

Question 9

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

Accepted Answer

Monitor > Logs > System or Authentication logs in Panorama.. RADIUS authentication failures and timeouts are logged in the System and Authentication logs in Panorama (Monitor > Logs). These logs capture the authentication request, response, and any timeout or communication errors with the RADIUS server. This is the correct place to diagnose the failure.

Answer

Policies > NAT.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > Threat.

Question 10

An administrator is configuring a Service Connection in Prisma Access and wants to ensure that traffic from remote networks to on-premises resources is routed correctly. The on-premises network uses BGP with a private AS number. Which configuration must be applied on the Prisma Access side to establish BGP peering?

Accepted Answer

Enable BGP on the Service Connection and specify the peer AS and peer IP address.. For BGP peering over a Service Connection, you must enable BGP and provide the peer AS and peer IP address. This allows dynamic route exchange with the on-premises router, which uses a private AS number. Prisma Access supports BGP over Service Connections, and this configuration ensures proper routing and failover for traffic destined to on-premises resources.

Answer

Configure a static route to the on-premises network.

Answer

Set up an IPSec tunnel with BGP over it.

Answer

Configure OSPF on the Service Connection.

Question 11

An architect is sizing a Prisma Access Remote Network location that experiences heavy video streaming traffic. Which factor is most critical when determining the required bandwidth license for this location?

Accepted Answer

The peak aggregate throughput of all users at the branch location. Remote Network bandwidth must be provisioned based on the peak aggregate throughput expected from all users behind the branch router.

Answer

The total number of IP addresses in the branch local DHCP scope

Answer

The number of active BGP peers configured on the branch router

Answer

The maximum transmission unit (MTU) size configured on the IPSec tunnel

Question 12

An administrator is troubleshooting a Prisma Access issue where mobile users cannot access a specific internal application hosted on-premises. The application is reachable via a Service Connection. The administrator has verified that the Service Connection is up and that the application is accessible from the Service Connection's tunnel interface. What is the most likely cause of the issue?

Accepted Answer

The Security Policy rule allowing traffic from mobile users to the Service Connection zone is missing or misconfigured.. The most likely cause is a missing or misconfigured Security Policy rule allowing traffic from mobile users to the Service Connection zone. Even if the Service Connection is up and routing is correct, without an explicit allow rule, traffic is blocked by default. Split tunnel, route advertisement, and DNS are less likely given the described symptoms.

Answer

The Service Connection's tunnel interface is not advertising the application's subnet to Prisma Access.

Answer

The mobile user's DNS is not resolving the application's FQDN to the correct IP address.

Answer

The mobile user's GlobalProtect app is not configured to include the application's subnet in the split tunnel.

Question 13

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Accepted Answer

Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.. Option A is correct because BGP peering requires the AS numbers to be properly configured: for eBGP the local and remote AS must differ and match each side's configured peer AS, while for iBGP both peers must use the same AS, so a mismatch prevents the session from establishing and routes from being learned. Option B is correct because even with an established session, Prisma Access will not learn any prefixes unless the CPE actually advertises them via BGP network or redistribute statements, so confirming the advertised prefixes is essential. Option D is correct because the BGP peer IP configured on Prisma Access must exactly match the CPE's BGP source/peer address (and vice versa) for the TCP session on port 179 to form; a mismatch means no peering and no route exchange. Option C is not relevant because WildFire cloud analysis is a threat-detection subscription and has no bearing on BGP route learning. Option E is not relevant because GlobalProtect portal SSL certificate expiration affects remote-user VPN authentication, not Remote Network BGP peering.

Answer

Verify the WildFire cloud analysis subscription status.

Answer

Check the GlobalProtect portal SSL certificate expiration date.

Question 14

An administrator is troubleshooting why mobile users cannot access a private application through Prisma Access ZTNA. The administrator has verified that the application is configured correctly and that the user is in the correct group. Which log type in Prisma Access should be examined to determine if the connection is being blocked by a security policy?

Accepted Answer

Traffic logs. Traffic logs are the most comprehensive source for troubleshooting access issues in Prisma Access. They record session details including the matching security policy rule, the action, and the reason for denial. This allows administrators to quickly identify if a security policy is blocking access to a private application. Other log types focus on specific security events and do not provide the same level of detail for policy enforcement.

Answer

URL filtering logs

Answer

Data filtering logs

Answer

Threat logs

Question 15

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

Accepted Answer

Panorama > Cloud Services > Setup > Support.. TSFs for Prisma Access can be generated under Panorama > Cloud Services > Setup > Support.

Answer

Device > Support > Tech Support File.

Answer

Monitor > Logs > System.

Answer

Policies > Security.

Certified Security Service Edge Engineer SSE-Engineer practice test

Three ways to study

Study SSE-Engineer by domain

Study SSE-Engineer by topic

Prisma Access Services practice questions

Prisma Access Troubleshooting practice questions

Prisma Access Planning And Deployment practice questions

Prisma Access Administration And Operation practice questions

SSE-Engineer fundamentals practice questions

SSE-Engineer scenario practice questions

SSE-Engineer troubleshooting practice questions

Certified Security Service Edge Engineer (SSE-Engineer) practice questions