Certified Security Service Edge Engineer (SSE-Engineer) (SSE-Engineer) — Questions 1–75

The GlobalProtect agent must gather host data such as patch level, antivirus and disk encryption, then forward it to the gateway; without enabling HIP data collection on the agent, no profile exists for the gateway to evaluate against policy.

Redistribution settings determine whether internal prefixes learned from the on-premises routing domain are propagated to Prisma Access. If redistribution is misconfigured or filtered, some subnets may be advertised intermittently or not at all. This directly affects which internal applications mobile users can reach through the Service Connection, matching the reported symptom.

To ensure all traffic, including internet-bound traffic, is inspected by Prisma Access, the GlobalProtect tunnel must be configured to route all traffic (0.0.0.0/0) through the tunnel. Additionally, split tunneling must be disabled so that no traffic bypasses the tunnel. This forces all traffic to the security processing nodes for inspection. This is the correct configuration for full traffic inspection.

Explicit proxy authentication loops occur when the proxy intercepts the identity provider's own login traffic, so credentials are never cached. Bypassing those login pages and correcting cookie persistence in the explicit proxy profile restores the authentication flow, satisfying the stem's repeated-prompt symptom.

To enable SSL decryption for mobile users, you must configure an SSL Decryption policy within the Mobile Users policy rules. This policy defines which traffic to decrypt based on source, destination, and other criteria. Without this policy, SSL traffic will not be decrypted, and SWG features like URL filtering and threat prevention will not function on encrypted traffic.

Cloud On-Ramp is a Prisma Access feature designed to optimize routing for cloud applications. It allows traffic to be directed to the nearest Prisma Access location and then to the cloud application, reducing latency and improving performance. By enabling Cloud On-Ramp, the organization can ensure that cloud-bound traffic from remote networks is efficiently routed and inspected, meeting both security and performance requirements.

For remote users, Prisma Access uses GlobalProtect to connect users to the nearest compute location. The administrator needs to configure GlobalProtect and onboard users, which enables security policy enforcement. This is the minimal configuration because no Service Connections or Remote Network connections are needed when there are no internal resources to access.

Checking the IKE and IPsec security associations helps confirm that the tunnel is established and that there are no mismatched parameters causing renegotiation or packet loss. If the security associations are flapping or using weak encryption, throughput can suffer. This action provides insight into the tunnel's health and stability, which are critical for performance. It is a fundamental step when troubleshooting slow throughput over an IPsec tunnel.

Prisma Access Cloud Management provides a Decryption policy under Security Services where administrators can create rules to decrypt SSL traffic. The policy can match on URL categories, source users, and other criteria, and supports exemption lists for categories that should not be decrypted. This is the correct location to enforce selective SSL decryption for mobile users.

Custom App-IDs bind non-standard TCP ports to application signatures, so App-ID inspection recognises and permits that traffic. Without this mapping, the firewall cannot identify the application on those ports, and security rules referencing the custom App-ID will not match, causing connection failures through the Remote Network node.

DNS server addresses reach GlobalProtect clients through the agent configuration pushed from the portal. Panorama > Prisma Access > Setup > Portal > Agent > Client Settings holds the DNS split-tunnel and server settings, satisfying the requirement that internal FQDNs resolve.

The Prisma Access monitoring interface provides traffic logs that show whether traffic was allowed or denied, and they include details such as the source, destination, and the service connection involved. Filtering by the application and service connection helps determine if the traffic reached the service connection and was forwarded or dropped. This is the most direct way to trace the traffic path within Prisma Access.

'Portal unreachable' means the client cannot establish the initial HTTPS connection to the portal, which happens before authentication or tunnel setup. Because other users at the same site connect fine, the issue is likely client-specific DNS resolution or a local firewall blocking the portal port. Confirming name resolution and port reachability directly tests the first connection stage that is failing.

IPsec tunnel statistics expose packet loss, rekey failures and latency across the tunnel, while Dead Peer Detection settings reveal flapping caused by missed keepalives or mismatched timers. Since the stem describes intermittent drops and high latency across remote branches, this directly targets the site-to-site VPN path rather than unrelated policy or endpoint causes.

Cloud Identity Engine consumes user and group data from an external directory, so an IdP integration such as Azure AD or Okta must exist first. Without that identity source, CIE has no directory to synchronise, making this a genuine prerequisite.

Prisma Access Insights provides a centralized view of Remote Network tunnel status, alerts, and health metrics. It is the appropriate dashboard to quickly determine if the IPsec tunnel is down or if there are ISP-related issues. This directly addresses the administrator's need to identify the cause of the offline site.

Prisma Access Insights is the cloud-delivered analytics service that aggregates health, status and traffic telemetry across all Prisma Access regions and tenants. It provides the centralised, cross-region visibility the question requires, unlike per-firewall or per-region monitoring tools.

Prisma Access mobile users authenticate through the GlobalProtect portal, so the SAML 2.0 authentication profile is referenced in the GlobalProtect Portal configuration under Authentication. This binds the external IdP to the portal that mobile users connect to.

ACC and Traffic/Threat logs expose session volumes, application mix and attack signatures traversing the nodes. Correlating a CPU spike with a traffic surge or exploit attempt identifies whether load is legitimate volume or malicious, directly addressing the need to find the workload driving utilisation.

SPNs run the full security stack inline, performing URL filtering with real-time category lookups against the cloud database. This satisfies the governance requirement by enforcing granular web access policy at every processing node without backhauling traffic.

Monitor → Logs → Authentication in Panorama records SAML assertion failures and IdP connectivity events for Prisma Access mobile users, directly satisfying the requirement to verify authentication timeouts. Unlike system or traffic logs, this log type captures the identity-provider exchange, letting the administrator confirm whether Microsoft Entra ID responses are reaching the gateway.

Private Applications are defined with the internal FQDN or IP, and Mobile Users must be able to resolve that FQDN. Because public DNS will not resolve an internal name, the administrator must ensure the GlobalProtect client uses a DNS server that can resolve the internal name, often via the portal/agent DNS configuration or split-DNS, so the browser connects to the Private Application tunnel.

Threat logs record Anti-Spyware and vulnerability events with the offending packet capture, severity, threat name and session details, giving the investigator the attack specifics that traffic, URL or WildFire logs do not retain for this signature-based detection.

BGP peer state is exposed through operational CLI commands and the Prisma Access routing status view, which report the live session between the remote network and customer CPE. This directly satisfies the requirement to verify real-time route exchange rather than inferring it from configuration.

Dual branch routers with independent IPSec tunnels remove the single device and single tunnel as failure points, so losing one router or tunnel still leaves branch traffic flowing to Prisma Access. This directly satisfies the redundancy requirement for the Remote Network location.

Authentication succeeded at the identity layer, so the drop originates in policy evaluation. A source zone mismatch or user-group mapping that does not match the incoming flow means no rule permits the traffic, producing the policy-deny entry despite CIE reporting the user as authenticated.

Prisma Access Insights provides Service Connection health including tunnel state and BGP session status. If the BGP session is down or flapping, internal routes will not be advertised, causing intermittent access to internal applications. This directly confirms whether the Service Connection is the source of the problem.

Local breakout allows mobile user traffic destined for the internet to egress directly from the Prisma Access location nearest to the user, rather than being backhauled to a service connection. If local breakout is not enabled or misconfigured, traffic may take a suboptimal path, causing latency. Verifying this feature ensures that SaaS traffic uses the best path. This directly addresses the performance issue.

A service connection is the component that lets Prisma Access infrastructure reach private applications in a data center or headquarters. In this scenario the branch traffic arrives at a mobile user location and must then be forwarded internally, so the service connection provides the IPsec tunnel and the associated routing to the data center subnets. Without it, the mobile user location has no path to the internal application, and the traffic would be dropped or sent to the internet.

Remote network configuration lives under Panorama's Cloud Services plugin, at Configuration > Remote Networks. This is the central management plane where branch onboarding, IPsec termination settings and licensing are defined before push to Prisma Access.

Panorama > Cloud Services > Status > Remote Networks lists each remote network's IPsec tunnel state, showing whether tunnels are up or down alongside peer and gateway details. This directly satisfies the requirement to check active IPsec tunnel status for a Remote Network location without navigating device-level CLI or per-firewall dashboards.

A Security policy rule with a HIP profile condition enforces the requirement. The HIP profile checks the OS version, and the rule allows traffic only when the HIP check passes. This directly ties the HIP profile to the security policy, ensuring that only compliant devices access internal applications. Without this rule, the HIP profile alone does not enforce access control.

The SSL Decryption logs provide detailed information about decryption successes and failures. If decryption is failing for the SaaS applications, the logs will show errors such as certificate issues or unsupported cipher suites. This is the most direct way to verify whether decryption is the root cause of the access issue, as it captures the actual decryption events.

Prisma Access relies on the identity provider group mapping being synchronized to the cloud service. If the user's current group is not yet reflected, the policy may match on stale membership data and apply decryption. This is a frequent cause of unexpected policy matches and should be verified in the identity mapping before changing policy logic.

This is correct because Prisma Access provides a built-in DNS proxy that can resolve DNS queries for mobile users. By configuring the mobile users' DNS server to point to the Prisma Access DNS proxy IP and enabling the DNS proxy feature, all DNS queries from mobile users are sent to and resolved by Prisma Access, allowing for DNS security policies to be applied.

Remote Network DNS queries traverse the Service Connection tunnel to reach internal DNS servers, so incorrect routing there black-holes them. Verifying this routing satisfies the stem's requirement to inspect components causing branch DNS resolution failure.

Client Settings under Mobile Users in Panorama's Cloud Services configuration pushes DNS server addresses and suffix to GlobalProtect mobile users, forcing internal name resolution through corporate resolvers. This satisfies the stem's constraint that mobile users must not fall back to public DNS.

The Traffic log records each session's action and the name of the rule that matched it, so filtering for 'deny' entries reveals exactly which policy rule is dropping the legitimate traffic. This directly satisfies the stem's requirement to identify the offending rule in Prisma Access.

Configuring two IPSec tunnels from the remote network to the same Prisma Access location, each using a different ISP, provides redundancy. If the primary ISP fails, traffic can fail over to the secondary tunnel over the secondary ISP. Prisma Access supports multiple tunnels per remote network, and this is a common design for high availability.

IPsec IKEv2 requires the branch router to present a routable public IP for peer identification and a pre-shared key that exactly matches the IKE gateway defined in Panorama, satisfying the authentication and reachability constraints needed for tunnel establishment with Prisma Access nodes.

EICAR strings and PANW test URLs are harmless, standardised payloads that trigger antivirus and URL-filtering signatures. Sending them and confirming blocks in the Threat log verifies signatures are active without introducing real malware into the environment.

Firewall as a Service provides Layer 3/4 inspection between virtual networks and cloud environments connected through Prisma Access, satisfying the east-west traffic inspection requirement. It enforces security policy on inter-VNet and inter-cloud flows that would otherwise bypass inspection.

The Cloud Identity Engine (CIE) ingests user and group information from identity providers and can map SAML attributes to Prisma Access policy groups. This allows dynamic assignment based on department attributes, enabling precise policy enforcement for the Finance department without on-premises infrastructure.

IPsec VPN tunnels terminate from the branch router or firewall directly into Prisma Access Remote Networks, which is the supported onboarding method for physical branch sites. This satisfies the requirement for a secure, encrypted connection over the public internet without dedicated circuits.

Pushing configuration to Prisma Access requires the Panorama Administrator role combined with Cloud Services plugin permissions, which grant access to the cloud management components. Without those plugin permissions, the administrator cannot commit changes to the cloud infrastructure.

The Data Filtering log records matches for data filtering and CASB inline policies, including the SaaS application, the matched rule, and the action taken such as alert or block. In this scenario it is the correct place to confirm whether the CASB policy matched the SaaS application and enforced the expected DLP action. If the log shows the file or data pattern was detected but the action differs from what was configured, the engineer can then inspect the rule order and profile settings.

In Prisma Access, remote networks only use service connections that are explicitly associated with them. If the administrator does not associate the service connection with the remote network, traffic from the branch to the data center will not be routed through Prisma Access for inspection; it may instead use local internet breakout or direct routes. Associating the service connection ensures traffic is forwarded to the data center via the secure tunnel and inspected by security policy.

The 'openssl s_client' command initiates a TLS connection to the specified host and port, and displays the certificate chain presented by the server. This allows the administrator to verify the certificate details, such as subject, issuer, and expiration. It is a standard and effective method to inspect the certificate the portal is using for HTTPS connections.

Antivirus and Anti-Spyware profiles are the only profile types that scan traffic streams for malware and spyware signatures. Attaching them to the Security policy rule satisfies the requirement to inspect outbound web traffic from mobile users through Prisma Access.

Prisma Access supports multiple IPsec tunnels from a remote network to the same service connection, each originating from a different public IP. This provides redundancy because if one tunnel fails, traffic can fail over to the other tunnel. The remote network's two static public IPs allow the engineer to configure two separate tunnels, and Prisma Access will accept both as part of the same remote network configuration.

Prisma Access mobile users are assigned to a region based on their location or configuration. If some users connect through a region that lacks a service connection to the remote network, they cannot reach the application. Others using a region with the service connection succeed. This explains the partial failure.

Prisma Access remote network tunnels are subject to capacity limits determined by the location's compute resources and the licensed bandwidth. If traffic exceeds the supported throughput, packets are dropped even though the tunnel remains up. Investigating the location capacity and license tier directly addresses the intermittent drops at higher rates.

The split-tunnel DNS suffix list governs which queries GlobalProtect forwards to internal resolvers, so a missing or malformed corporate domain entry here directly explains internal-only resolution failures while external lookups succeed. Verify the DNS suffix and resolver settings under Client Config, since that configuration is pushed to mobile users and overrides local device DNS behaviour.

The Prisma Access dashboard includes a Health section that displays the status of remote networks, including whether the IPSec tunnel is up and whether traffic is flowing. This is the primary place to verify tunnel establishment. The administrator can see green/red indicators and details about the tunnel state, making it the first check for operational status.

Prisma Access Insights is the monitoring and analytics application that aggregates telemetry from Prisma Access and presents dashboards for Mobile Users, Remote Networks, Service Connections, and overall health. It gives the high-level view of connected users, locations, and application usage that the administrator needs to verify the new tenant.

Prisma Access assigns virtual IPs to GlobalProtect clients automatically from its own pool, removing the need for external DHCP or manual configuration. This satisfies the mobile-user scenario's requirement for scalable, low-administration address assignment across distributed clients.

Prisma Access Remote Networks allow branch offices to connect to the closest security processing node, where traffic can break out to the internet locally after security inspection. This minimizes latency to SaaS applications because traffic does not need to backhaul to a central location. This is the intended design for optimizing SaaS access.

Prisma Access Insights delivers real-time operational dashboards covering mobile user connections, bandwidth consumption per region and tunnel status. It is the dedicated monitoring service for Prisma Access, directly satisfying the administrator's requirement for these specific live metrics.

Network performance is a key factor.

Inline CASB inspects the SaaS application session itself, so policy can distinguish operations within a sanctioned tenant — permitting viewing or download while blocking uploads — rather than merely allowing or denying the whole application by URL category.

Traffic logs in Prisma Access Insights or Strata Logging Service contain fields such as 'Service Connection' or 'Source Service Connection' that identify the egress point for the session. Filtering by user and application will reveal the specific Service Connection in use, allowing the administrator to confirm the region and troubleshoot latency. This is the correct method to verify the actual path taken.

Remote Network is the Prisma Access component that connects branch offices to Prisma Access via IPSec tunnels, enabling internet-bound traffic to be secured. It is specifically designed for site-to-site connectivity from branch locations. This is the correct component to deploy for branch office internet security.

Panorama's Cloud Services status page reports the live IPsec tunnel state for each remote network, including IKE and IPSec security association status. This directly satisfies the requirement to verify tunnel health and status for the remote network connected via IPsec VPN.

Client-less VPN renders access through a browser, requiring no GlobalProtect agent installation. This satisfies the constraint that contractors use managed or unmanaged devices where agent deployment is impossible, while still enforcing least-privilege, identity-based access policies.

The HIP Match log records each HIP check result, including which host profiles passed or failed for a connecting user. Reviewing Monitor > Logs > HIP Match therefore shows exactly why the mobile user's checks are failing.

Monitor > Reports in Panorama retains aggregated historical data, including bandwidth and traffic trends, over configurable periods such as the last 30 days. This satisfies the requirement for historical reporting on a specific Remote Network location.

Mobile users reach internal corporate applications through the Service Connection, not directly through the GlobalProtect tunnel alone. With that connection reporting Down, traffic destined for internal subnets has no path, while internet-bound traffic still egresses. Restoring the Service Connection IPsec tunnel re-establishes the route to the data center and resolves the internal-only reachability failure.

The Service Connection provides the path from Prisma Access to the data center. If the Service Connection is down or the static routes for the data center subnets are missing, Prisma Access cannot forward traffic to the internal applications. Verifying the Service Connection status and its routes directly confirms whether the return path exists.

The show vpn ike-sa gateway command displays IKE phase 1 security association state and parameters for the named gateway. Running it reveals why negotiation fails, directly satisfying the need to check IPsec tunnel status and IKE SA details during phase 1 troubleshooting.

Prisma Access mobile user address pools must not overlap with internal subnets that clients need to reach, because overlapping routes create ambiguity in the GlobalProtect routing table. Reconfiguring the pool to a unique, non-overlapping range and pushing the change resolves the conflict and allows users to reach the internal 10.20.10.0/24 resources normally.

This design meets both requirements: internal traffic is routed through the Europe Service Connection to the data center, and internet-bound traffic is inspected at the nearest compute location, minimizing latency. Prisma Access allows policy-based routing to direct traffic based on destination, so internet traffic can be sent to the internet via local compute locations while internal traffic goes through the Service Connection.

Security profiles attach to Security Policy rules, so placing them in the Panorama rule that matches mobile-user traffic ensures that traffic is inspected by exactly those profiles. The constraint is profile enforcement during policy evaluation, which only rule-level attachment satisfies.

The Cloud Identity Engine Agent runs on-premises and initiates outbound connections to CIE, synchronising Active Directory objects without requiring any inbound firewall ports to be opened. That outbound-only design is precisely what the scenario's security constraint demands.

Cloud Identity Engine syncs Active Directory groups, so the Security rule's Source User field must reference the fully qualified group name CIE provides; this lets policy match users by synced group membership rather than individual accounts.

Log forwarding profiles must be attached to security policy rules for the relevant log types to be sent externally. If the profile is not attached, logs remain in the local data lake and are visible in dashboards but never forwarded to the SIEM. This directly explains why the dashboard shows activity while the SIEM receives nothing.