Certified Security Service Edge Engineer (SSE-Engineer) (SSE-Engineer) — Questions 76–150

GlobalProtect mobile users in Prisma Access can authenticate directly against external RADIUS and LDAP servers, which Prisma Access queries natively without additional brokers. This satisfies the stem's requirement for natively supported authentication methods for mobile users.

Specifying the BGP peer AS number and peering IP addresses enables dynamic route exchange between the Service Connection and the corporate data centre. This satisfies the Service Connection configuration requirement, allowing Prisma Access to learn and advertise routes over the IPSec tunnel.

The CLI command 'show user ip-user-mapping all' lists IP-to-user mappings, confirming whether User-ID has populated entries for mobile users. Checking User-ID status in the Prisma Access monitoring dashboard corroborates this, revealing missing mappings that cause group-based security policies to fail matching traffic.

SAML assertions are signed by the IdP's private key and validated against the imported certificate. If Panorama holds a stale or mismatched signing certificate, signature validation fails and authentication is rejected, directly explaining the mobile user login failure.

QoS in Prisma Access is enforced through security policy rules, so a profile attached to the wrong rule never matches the VoIP traffic. Guaranteed bandwidth must also fit within the provisioned node's capacity; oversubscription causes the guarantee to be ignored, leaving bulk transfers competing unchecked.

The User Activity report in Prisma Access Insights provides detailed information about user sessions, including bandwidth consumption per user. It allows administrators to sort and filter by bandwidth usage over a specified time period, such as the past 24 hours, making it the appropriate tool to identify top bandwidth consumers among mobile users.

For remote network users to access internal applications, Prisma Access must know the routes to those subnets. The service connection must advertise the internal subnets from the data center to Prisma Access. This enables Prisma Access to route traffic from the remote network to the data center. Without these routes, traffic cannot reach internal applications.

Seamless tunnel reconnection preserves the tunnel and security associations while the underlying transport changes, letting GlobalProtect re-establish rapidly as users roam between Wi-Fi and cellular. 'Always On' keeps the tunnel enforced, satisfying the stem's session-persistence requirement.

User-ID and group mapping are foundational for ZTNA 2.0, as they allow policies to be based on user identity and group membership. This ensures that only authorized users can access specific private applications, aligning with least-privilege principles and enabling continuous trust verification through identity context.

Prisma Access supports a single tenant with multiple compute locations, and security policies are applied uniformly across all locations when using the same policy rules. GlobalProtect automatically selects the closest compute location, ensuring consistent enforcement. This meets the requirement for uniform security policy and optimal routing.

Address objects and Address Groups let you define the internal application's IPs once, then reference that group across policies. This satisfies the scalability constraint: adding or changing application subnets updates every dependent rule automatically, rather than editing each policy individually.

Prisma Access evaluates security policy rules top-down and stops at the first match. If an allow rule earlier in the rulebase matches the same traffic, the deny rule for the specific user will never be evaluated. The administrator should check rule order and ensure the deny rule is above any broader allow rules that could match the user's traffic. This is a common cause of unexpected allows.

Signature validation compares the SAML assertion's signature against the certificate stored in the authentication profile. If the IdP has rotated to a new signing certificate while Prisma Access still holds the old one, validation fails even though authentication at the IdP succeeded.

The Prisma Access for Networks license provides remote network connectivity for branch offices, allowing them to connect to Prisma Access via IPSec tunnels. This license is specifically designed for site-to-site connectivity and does not include mobile user entitlements. It enables branch traffic to be secured and routed through the Prisma Access infrastructure.

IPsec establishment requires matching peer identities; if Panorama's configured peer public IP differs from the branch router's actual public IP, IKE negotiation fails. Verifying this match directly addresses the tunnel failure described in the stem.

Internal subnets reach the tunnel only if the remote network knows where to send them. Advertising them via BGP peering with the on-premises router, or defining static routes for those subnets, populates the routing table so traffic is steered into the IPSec tunnel rather than the default path.

If the user can access internal resources by IP but not by hostname, DNS resolution is failing. The GlobalProtect portal agent configuration specifies the DNS servers pushed to clients. If the DNS server list for the user's region is incorrect or missing, the user cannot resolve internal hostnames. Verifying this configuration is the logical first step.

The remote network status view displays the IPSec tunnel state for each onboarded site. A connected state confirms that IKE and IPSec negotiations succeeded and the branch firewall established the tunnel to the correct service connection, which is the primary indicator that the remote network is operational.

DPD tears down tunnels when peers disagree on interval and retry timers, because one side declares the peer dead before the other responds. Aligning these values between the customer CPE and the Prisma Access node prevents spurious teardown of an otherwise healthy IPsec tunnel.

IPsec crypto profiles and tunnel parameters define the IKE and ESP encryption, authentication and lifetime settings both peers must match. Prisma Access requires these to negotiate the branch tunnel, satisfying the requirement for a secured connection to the cloud security backbone.

Prisma Access requires an explicit association between each remote network and the service connections it may use. Without this association, the cloud infrastructure cannot map traffic from that remote network to a service connection, producing the 'no matching service connection found' message. The administrator must edit the remote network configuration and add the service connection under the appropriate association setting.

HIP checks collect endpoint posture data such as domain membership and registry keys, letting Prisma Access apply different security policies to managed corporate laptops versus unmanaged contractor devices. This satisfies the requirement to distinguish endpoint ownership during connection, since GlobalProtect reports host attributes the gateway evaluates before granting access.

The Cloud Services infrastructure status page exposes the running Prisma Access tenant version, since the cloud infrastructure is managed by Palo Alto rather than on-premises Panorama. This is the only location displaying the deployed cloud version.

Vulnerability Protection profiles inspect traffic for exploits targeting known software flaws, blocking attempts to leverage unpatched services. This satisfies the requirement for comprehensive protection against unknown threats by detecting anomalous exploit patterns, complementing anti-malware scanning on outbound and internet-bound rules.

Security policy rules match traffic on source and destination security zones, which identify the origin and target segments of the connection. Zones are one of the three supported match criteria, letting policy control traffic traversing the cloud infrastructure.

Prisma Access includes predefined reports that summarize security policy rule usage, showing which rules are hit most often. This directly provides the requested 30-day view across mobile users and Remote Networks, giving the security team a single dashboard of rule frequency without custom log queries.

Prisma Access SSL Decryption policies allow administrators to define rules that bypass decryption for specific URL categories, such as financial services or healthcare. This enables threat inspection for most traffic while respecting privacy regulations for sensitive sites. The no-decrypt rule ensures that traffic to those categories is not decrypted but can still be logged or subject to other controls. This is the standard approach for balancing security and privacy.

Continue is a configurable URL Filtering action that permits the request while logging it, unlike block or alert. It satisfies the stem's requirement to identify actions available within a Prisma Access URL Filtering profile for high-risk categories.

Mobile users depend on GlobalProtect to send user-to-IP mappings to Prisma Access. Verifying that the agent reports mappings and that authentication logs show successful logins isolates whether the failure is a reporting or authentication problem, satisfying the troubleshooting requirement.

MSS clamping rewrites the TCP maximum segment size so packets fit the tunnel MTU, preventing fragmentation before it occurs. Correctly handling ICMP Destination Unreachable (fragmentation needed) lets endpoints discover the path MTU, resolving the drops.

Traffic logs record session end reasons, so timeouts, TCP resets and policy drops appear here, directly evidencing why a mobile user's connection terminates after a short period. This log therefore satisfies the stem's requirement to identify the cause of repeated drops.

Split-DNS resolution fails partially when suffix entries are malformed or the client OS search-domain limit is exceeded, so only some internal domains resolve. Correcting suffix formatting and reducing entries below the OS maximum restores resolution for the affected domains.

URL Filtering logs specifically record the URL category, the action taken (allow, block, alert), and the matched profile. This is the most direct way to confirm if a URL Filtering profile blocked the user's access. These logs are generated when a session matches a URL Filtering policy.

Mobile Users locations are the points of presence where remote users connect to Prisma Access. By enabling multiple locations and using GlobalProtect with the closest server selection, users automatically connect to the nearest available location. This minimizes latency and improves performance. The engineer should configure Mobile Users locations in North America and Europe to meet the requirement.

BGP import/export rules on the Service Connection control which routes are accepted and advertised. If the specific subnet is filtered out by an import rule, Prisma Access will not install the route even though the BGP session is up. Checking these rules ensures the advertised route is accepted and used.

Prisma Access runs its Security Processing Nodes on Amazon Web Services and Google Cloud Platform, giving the service its global points of presence. These two providers host the SPNs that perform security inspection closest to users.

Prisma Access routes Remote Network traffic through its security cloud, where a single policy set is enforced and inspected. This removes the per-tunnel policy sprawl of traditional site-to-site VPNs, satisfying the requirement for consistent, centrally managed enforcement across all sites.

User-ID and authentication profiles are needed to map Mobile Users to corporate identities, enabling user-based security policy. Without User-ID, policies can only match on IP or other non-user criteria, failing the requirement to identify users by corporate credentials. This component is essential for the scenario.

LDAP directory authentication is natively supported for GlobalProtect mobile users in Prisma Access, letting the administrator validate credentials against an existing directory service. It integrates directly with the portal and gateway authentication profiles without additional brokers.

Inbound decryption terminates TLS at Prisma Access, which then re-encrypts to the backend using a certificate bound to the rule. If that server certificate and private key are missing or mismatched in Panorama, clients receive warnings, so verify the binding first.

Vulnerability Protection profiles detect and block exploits targeting software flaws, such as buffer overflows and code execution attempts. Attaching them to Security Policy rules across all zones satisfies the stem's requirement for comprehensive threat prevention.

This is correct because directing all traffic to the Prisma Access tunnel ensures that internet-bound traffic from the branch is sent to Prisma Access for security inspection. The static route forces traffic through the IPSec tunnel, where Prisma Access applies security policies. This is a standard configuration for Remote Networks to achieve consistent security enforcement.

Prisma Access ADEM delivers synthetic and real-user monitoring across the full traffic path, capturing hop-by-hop network telemetry, application response times and endpoint experience metrics. This satisfies the stem's demand for end-to-end visibility plus DEM, which basic health dashboards or log-only tools cannot provide.

The Explicit Proxy Service in Prisma Access is specifically designed to handle explicit proxy traffic. It must be configured with a proxy server address and port, and appropriate security policies must be applied. This service inspects web traffic from users who manually configure their browsers to use a proxy, ensuring consistent security enforcement.

Anti-Spyware signatures identify and block known command-and-control traffic, while Vulnerability Protection profiles detect and stop exploit attempts against vulnerable services in real time. Applying both satisfies the stem's requirement to block C2 and exploits dynamically on outbound remote-network traffic.

Restricting advertised gateways to the user's region and setting a clear primary gateway reduces unnecessary gateway switching. The agent selects gateways based on priority and response time; limiting options and defining priority stabilizes selection. This directly addresses the intermittent drops caused by repeated selection changes.

Prisma Access can insert specific HTTP headers (such as Restricted-Access-Current-Tenant) into outbound requests to cloud services, forcing corporate tenants only.

Mobile Users is the Prisma Access component that enables remote and mobile users to connect directly to Prisma Access using GlobalProtect. This allows users to access the internet and internal applications without backhauling traffic through the corporate data center. Configuring Mobile Users is essential for this scenario because it provides secure, direct connectivity for individual endpoints.

A Threat Prevention profile on the Security Policy rule inspects traffic for vulnerabilities, spyware, and command-and-control activity. It is essential for threat inspection. Without it, malicious content might pass. Thus, it is required alongside URL Filtering to meet the requirement of inspecting for threats.

For mobile users to access internal applications in a branch office, Prisma Access must have a route to that branch office network. This is typically via a Service Connection or remote network tunnel. If the Service Connection is down or routing is misconfigured, traffic will be dropped. Checking this is crucial because internet access working does not guarantee internal network reachability.

A Service Connection connects Prisma Access to the corporate data center, allowing remote users to access internal applications. By configuring the Service Connection and advertising the internal subnets, Prisma Access can route traffic from remote users to the data center. This is the correct component for private application access.

Prisma Access supports SAML attributes to dynamically assign users to groups based on IdP assertions. These groups can be used directly in security policies, enabling granular control without separate portals or gateways. This leverages existing SAML integration and is the most efficient method for policy differentiation.

Configuring Cloud Identity Engine settings in Panorama syncs directory services and maps users to IP addresses for GlobalProtect mobile users in Prisma Access. This satisfies the User-ID requirement, since CIE supplies the user-to-IP mapping that the firewall consumes.

This is correct because to inspect web traffic for threats, you must attach a threat prevention profile to the security policy rule that permits the traffic. The profile includes antivirus, anti-spyware, and vulnerability protection, which detect and block threats. Without it, traffic may be allowed without inspection, violating the requirement.

Enabling Local Internet Breakout on the Remote Network sends internet-bound traffic directly out the branch's assigned public IP rather than through headquarters. Traffic logs confirm this by showing sessions egressing via that IP, proving local breakout is functioning.

Service Connections forward traffic only for prefixes present in their routing table. Without correct static routes or BGP advertisements covering the internal subnets, Prisma Access has no matching route and falls back to the internet default path.

Dynamic routing across redundant IPsec tunnels requires BGP peering established over both tunnels to the Prisma Access service node, allowing the CPE router to learn and fail over routes automatically. This satisfies the high-availability requirement for the Remote Network location.

A mismatch in IKE or IPsec proposal parameters can allow the tunnel to negotiate initially yet fail on rekey, producing a tunnel that establishes and then drops within minutes. Verifying that encryption, hash, and Diffie-Hellman settings match on both peers directly addresses the intermittent flap. Aligned proposals ensure both phases negotiate and rekey reliably, which is essential for a stable Service Connection.

HIP Match logs are generated specifically when host information profile data changes or a device fails a compliance check, capturing the endpoint's posture state. This directly satisfies the stem's requirement to record HIP change and compliance failure events, unlike traffic, threat, or system logs.

GlobalProtect HIP profiles collect endpoint antivirus presence and definition update status, letting Prisma Access ZTNA deny access when signatures are missing or stale. This satisfies the endpoint hygiene verification requirement before internal applications are reached.

ACC aggregates application traffic by App-ID, letting you confirm whether the cloud application is being identified and permitted, or silently blocked by a security policy or decryption profile. It satisfies the need to analyse application-level behaviour for the specific unreachable app.

Config logs in Panorama record administrative configuration changes, including the administrator identity and timestamp. Reviewing Monitor > Logs > Config therefore reveals who modified the security policy during the past week, matching the audit requirement.

Commit validation in Prisma Access Cloud Management allows an administrator to preview configuration changes and catch errors before committing them to the production environment. It performs a syntax and dependency check, ensuring that the configuration is valid and will not cause service disruption. This directly satisfies the requirement to validate changes before pushing to production.

The GlobalProtect app collects Host Information Profile data from the endpoint, reporting disk encryption status and running endpoint protection agents. Prisma Access evaluates this HIP report before tunnel establishment, enforcing ZTNA 2.0 posture checks for remote mobile users.

A service connection provides the IPSec tunnel and routing that carries headquarters-bound traffic from the data centre into Prisma Access, satisfying the requirement for secure connectivity to the corporate data centre rather than remote-user or internet-bound access.

Service Connections link Prisma Access to the customer's internal network, allowing mobile users and remote networks to reach internal applications. Combined with security policy and threat inspection, this enables authenticated mobile users to access on-premises web applications securely. It is the correct component for extending internal access to Prisma Access.

This is correct because in Prisma Access, to route specific private IPs from mobile users through a service connection, you configure static routes on the service connection and enable advertisement to mobile users. This ensures traffic to 10.10.10.50/32 is sent over the service connection for inspection, while other traffic follows the default internet path.

The CLI 'test security-policy-match' command evaluates a synthetic flow against the compiled rulebase and returns the matching rule, so it isolates whether policy logic or another factor blocks traffic. This satisfies the stem's need to verify rule evaluation for a specific source, destination and application.

By applying an inbound filter on the Service Connection to reject the default route, Prisma Access will not install the 0.0.0.0/0 route from the data center. This ensures that internet-bound traffic from Remote Networks is not sent back to the data center but instead is routed to the internet directly from Prisma Access, where it can be inspected. This is the correct method to prevent the default route from affecting traffic steering.

Panorama's Job Status page records each configuration push task and its associated error codes. Reviewing failed tasks there exposes the specific reason a push to Prisma Access nodes did not complete, directing the administrator to the underlying misconfiguration.

Traffic logs contain fields such as 'Rule' that indicate which security policy rule was applied to a session. By filtering for the user and the session details, the administrator can see the exact rule name and whether the action was allow or deny. This directly answers the question.

Bandwidth considerations are crucial for scalability and performance. Each Remote Network location must have sufficient ISP bandwidth to handle the expected traffic load. If the aggregate bandwidth is insufficient, traffic may be dropped or delayed. Additionally, Prisma Access has limits on the bandwidth per tunnel, so multiple tunnels may be needed. Therefore, the architect must consider both the ISP bandwidth and the total aggregate bandwidth required.

Prisma Access allows you to deploy multiple mobile user locations, each with its own set of Security Processing Nodes in the specified region. By assigning users to the nearest location, traffic is inspected locally, reducing latency. This directly satisfies the requirement for dedicated SPNs in each region.

Inline CASB sits in the data path, so it inspects traffic in real time and blocks uploads as they occur, satisfying the stem's comparison against out-of-band SaaS Security API, which only detects via API polling after the fact. This inline enforcement is the axis of difference.

The Service Connection must be enabled and properly configured with correct IPsec parameters (such as IKE and IPsec crypto profiles, and pre-shared keys) to establish tunnels. If it is disabled or misconfigured, the connection will fail. Checking these settings in the Prisma Access portal is a fundamental step to ensure the Service Connection is correctly provisioned and ready to accept or initiate tunnels.