Certified Security Service Edge Engineer (SSE-Engineer) (SSE-Engineer) — Questions 151–225

Panorama centrally manages Prisma Access configuration, including remote network bandwidth allocation for each compute location, then pushes it to the service. This satisfies the requirement to define and deploy bandwidth settings from a single management plane.

To establish BGP peering over a Service Connection, you must enable BGP and configure the peer AS number and peer IP address. This allows Prisma Access to exchange routes with the on-premises router. The private AS number is supported, and the configuration is done in the Prisma Access service connection settings, ensuring dynamic routing and failover.

Panorama's System and Authentication logs capture RADIUS timeout and communication errors generated by the mobile users' GlobalProtect authentication path, satisfying the requirement to locate these events centrally. System logs record daemon-level failures, while Authentication logs detail per-user RADIUS exchanges, so both must be inspected to diagnose the failing authentication.

Periodic HIP re-evaluation plus app-connector telemetry continuously revalidates user identity and device posture throughout the session, not just at login. This satisfies ZTNA 2.0's continuous trust verification requirement for mobile users reaching internal private applications.

Monitor > Logs > Threat displays threat signatures and verdicts in real time, letting the administrator filter by the specific mobile user to see why the malicious file was blocked. Other log types lack threat verdict detail.

HIP reports only reach Prisma Access if the GlobalProtect client generates and submits them at the configured intervals. Checking these settings in Panorama confirms the reporting mechanism itself is enabled, which is a prerequisite before any compliance evaluation can occur.

The GlobalProtect agent logs on the endpoint record the routes and DNS settings pushed by the gateway during connection. By examining these logs, the engineer can see if the internal subnet is included in the split-tunnel routes. If the route is missing, the client will not send traffic for that subnet through the tunnel, causing access failure. This is a direct method to verify the client's effective routing table.

DNS Security continuously analyses DNS queries and applies predictive analytics to block newly registered malicious domains at resolution time, satisfying the requirement for automatic blocking without manual signature updates. It delivers real-time domain and IP threat intelligence to Prisma Access, unlike static URL filtering or scheduled signature feeds.

Running BGP over the IPsec tunnels lets Remote Networks advertise and learn routes dynamically, so traffic reroutes automatically when a tunnel fails. This removes the need for manual or static failover, directly satisfying the stem's high availability and redundancy requirement.

Local Breakout on a Remote Network allows the branch firewall (the Prisma Access-managed IPSec tunnel endpoint) to send selected traffic directly to the internet instead of through the Service Connection. Using an Application filter, the administrator can permit SaaS applications to egress locally while still forwarding other traffic through the corporate data center.

Traffic logs record each session's policy match and include a Drop Reason field, letting the administrator confirm in real time whether a security rule blocked the flow. Filtering by source user and destination IP isolates the affected application traffic immediately.

The System log records GlobalProtect and ZTNA tunnel lifecycle events, including connection attempts, tunnel establishment failures, and authentication timeouts. It captures the gateway selection and HIP-related errors that mobile users encounter, directly satisfying the stem's requirement to diagnose tunnel establishment alongside authentication problems.

Compute Locations host the security processing nodes that mobile users' tunnels terminate on, so decryption, content inspection and threat prevention execute there. The constraint is inspection of mobile-user traffic, which requires the compute node rather than management or portal components.

Prisma Access Remote Networks support multiple IPSec tunnels to different locations for redundancy. If one location becomes unavailable, traffic can fail over to the other tunnel. This provides high availability even with a single ISP connection, as the tunnels terminate at different Prisma Access points of presence. This is the recommended approach for redundancy.

Security Profiles attached to allow rules provide Antivirus, Anti-Spyware and Vulnerability Protection scanning, so permitted traffic is still inspected. This satisfies the best-practise requirement for security coverage, since allow rules without profiles would pass traffic uninspected.

The GlobalProtect gateway is the component that enforces security policies, including split tunneling, for connected remote users. It receives the split tunneling configuration from the Prisma Access configuration and applies it to user traffic. Thus, it is the correct answer because it directly controls how traffic is routed based on the split tunnel policy.

URL Filtering blocks are recorded in URL Filtering logs, which show the URL category, the matched profile, and the action taken. Because mobile users succeed while remote network users fail, the difference is likely in which profile or category configuration applies to the remote network path. Filtering URL logs by those users and the destination reveals the exact category and rule causing the block.

Address objects and tags define the precise source and destination criteria that Prisma Access security policies match against, ensuring rules apply only to intended traffic. Without them, policy scope remains undefined, so traffic cannot be correctly classified or enforced — satisfying the stem's requirement that policies be correctly applied.

Monitor > ACC in Panorama aggregates traffic logs into bandwidth usage, top applications, and top users, letting administrators inspect a specific Service Connection's throughput. It satisfies the requirement to monitor traffic volume and identify the heaviest consumers without manually parsing raw session logs.

Kerberos requires direct line-of-sight to a domain controller for ticket issuance, so remote GlobalProtect users off-network cannot reach internal Active Directory Domain Controllers unless a Service Connection provides routing. Without that path, ticket requests fail, producing the reported authentication prompt failures.

A Service Connection is required to connect Prisma Access to the corporate network or data center where private applications reside. Without it, mobile users cannot reach private applications through Prisma Access. This configuration ensures that traffic to private applications is routed through Prisma Access for inspection and policy enforcement.

The Directory Service connector syncs users and groups from Active Directory into Cloud Identity Engine, providing the identity data Prisma Access needs for user mapping. This satisfies the stem's requirement for a required CIE deployment component.

Prisma Access supports role-based access control where an administrator can be granted read-only visibility into logs and reports without configuration rights. Assigning such a role satisfies the requirement that the analyst review logs and reports while being unable to modify policies, objects, or Prisma Access settings.

The Prisma Access Dashboard provides health metrics for Service Connections, including latency, jitter, and packet loss. These metrics are specifically designed to monitor the performance of the connection between Prisma Access and the remote network or internet. This is the most appropriate tool to identify if the Service Connection is causing slow access to cloud applications.

Split tunnelling sends non-corporate and high-bandwidth traffic such as video streaming straight to the internet, bypassing the Prisma Access inspection path. This removes that traffic from the tunnel, cutting round-trip latency and freeing tunnel capacity, directly satisfying the stem's goal of optimising mobile user performance.

DPD detects if the peer is unreachable. If the DPD interval is too short or retry count too low, transient network issues can cause the tunnel to be torn down and re-established, leading to flapping. Increasing the DPD interval and retry count makes the tunnel more tolerant of brief disruptions, reducing unnecessary flapping. This directly addresses the suspected cause and is the correct parameter to adjust.

Panorama's Cloud Services status page surfaces live gateway health and mobile user session data for Prisma Access, showing whether each GlobalProtect gateway is responding. This directly satisfies the requirement to verify real-time gateway responsiveness to client connection requests.

In Prisma Access, SSL decryption alone does not block malicious sites; it only decrypts traffic for inspection. To block known malicious domains, a URL filtering profile must be applied to the security policy rule that permits the traffic. If the URL filtering profile is missing or not attached to the rule, the traffic will be decrypted but not blocked. The administrator must ensure the security policy rule includes the URL filtering profile configured to block malicious categories.

Traffic logs provide detailed information about the sessions initiated by the user, including the source, destination, application, and the security policy that was applied. When a user cannot access internal resources, the traffic logs will show whether the traffic is being allowed or denied and which rule is responsible. This is the most direct way to identify the cause of the block. Reviewing traffic logs is a fundamental first step in troubleshooting access issues.

GlobalProtect establishes a tunnel from the endpoint to the Prisma Access security processing node, which then inspects all traffic including web traffic for threats and URL filtering. In this scenario it is the simplest deployment because the GlobalProtect app handles the connection and no per-endpoint proxy configuration or trust certificate is needed for basic inspection. It also covers all traffic from the endpoint, not only browser web traffic, meeting the requirement to inspect all web traffic.

Threat and WildFire logs record whether each file was inspected, logged or bypassed. Exclusions silently skip inspection, so a malicious download may never be scanned. Reviewing these logs reveals whether an exclusion or profile misconfiguration prevented blocking.

Panorama's URL Filtering lookup tool queries the cloud URL database directly, returning the category a site belongs to and the policy rule that matches. The CLI equivalent, 'test url <website>', performs the same check, confirming why a supposedly blocked category is permitted.

The portal presents its assigned SSL/TLS certificate during the GlobalProtect handshake; an expired, mismatched or untrusted certificate triggers the client's invalid certificate error. Verifying this element satisfies the stem's constraint that the failure originates at the portal's certificate configuration.

The Prisma Access infrastructure settings define the basic parameters such as the tenant name, the service connection type (e.g., IPSec or BGP), and the locations for mobile users and remote networks. These settings must be configured first because they determine how the rest of the deployment is structured. Without them, you cannot proceed to configure Remote Networks or Service Connections.

Asymmetrical routing prevents the firewall from seeing both sides of a handshake, leading to 'incomplete' sessions.

Path quality monitoring continuously probes each ISP link and, when the primary link's metrics recover, triggers failback so the preferred path is restored automatically. This directly addresses the described symptom where traffic remains on the backup link after the primary ISP recovers, and it requires no manual administrator action.

IPsec negotiation fails outright when the two peers' IKE Phase 1 and Phase 2 proposals disagree on encryption, authentication or Diffie-Hellman group. Comparing these parameters on the CPE against the Prisma Access Remote Network node directly satisfies the stem's requirement to identify why the tunnel cannot establish.

Even if the remote network advertises the subnet, the service connection may have a BGP import policy that denies or filters the route. This would prevent the route from being installed in the routing table. Checking the import policy on the service connection is crucial to resolve the missing route.

BGP peering requires matching or correctly mapped Autonomous System numbers between Prisma Access and the customer CPE. Mismatched AS configuration causes the session to fail or routes to be rejected, directly explaining why the CPE prefixes are never learned.

The GlobalProtect app logs on the endpoint contain information about the routes that are added to the client's routing table based on the split tunnel configuration. By examining these logs, the administrator can see exactly which subnets are included or excluded, confirming whether the internal application's subnet is correctly routed through the tunnel. This is the most direct method to verify the effective split tunnel behavior on that specific user's device.

Security profiles are attached to security policy rules in the Prisma Access policy configuration. To verify that threat inspection is applied, the administrator must check the specific rule that matches the user's traffic and confirm that the appropriate security profiles (e.g., Antivirus, Anti-Spyware) are selected. Without profiles attached, traffic is allowed but not inspected. This is the direct place to validate profile attachment.

The GlobalProtect Portal is the initial endpoint users connect to; it authenticates them, delivers the agent installer, and returns the list of available gateways. Hosting the agent software and gateway lists is therefore its primary function in a Prisma Access deployment.

Bandwidth licensing for a remote network location is sized against the peak aggregate throughput demanded by all users simultaneously, not average usage. Video streaming drives sustained high bitrates, so this peak figure determines the licence tier that prevents congestion.

Shadow IT discovery identifies unsanctioned SaaS applications traversing Prisma Access and assigns risk scores, giving the administrator visibility needed to govern file-sharing and collaboration tools. It satisfies the granular control requirement by surfacing unapproved apps for policy action.

Traffic and Threat logs are native Panorama log types that record session flows and security event matches from Prisma Access. They give the administrator the flow-level and threat-level visibility the stem requires for troubleshooting security events and traffic flows.

Service connections in Prisma Access must be associated with the locations where mobile users connect. If the service connection is not linked to the correct locations, mobile users' traffic will not be routed to the on-premises data center. This association is configured in the service connection settings, and verifying it ensures that users in those locations can access private applications through the service connection.

Panorama's Cloud Services licence view exposes Prisma Access subscription entitlements, including WildFire, Threat Prevention and URL Filtering, so an administrator can confirm which services are active against the tenant. This satisfies the stem's requirement to verify licence status and active subscriptions directly from Panorama.

GlobalProtect split tunnelling with access routes and domains directs only the specified SaaS traffic outside the tunnel, so that traffic egresses directly to the internet rather than through Prisma Access processing nodes. This satisfies the stem's requirement to bypass cloud security inspection for those applications while other traffic remains protected.

Before any Remote Networks or Service Connections can be configured, the Prisma Access license must be activated and the infrastructure allocated. This process provisions the necessary security processing nodes and network components in the cloud. Without this step, the Prisma Access service is not available for configuration, making it the essential first step.

Prisma Access uses application identification to determine the best Service Connection for SaaS traffic. If the application is recognized, Prisma Access can route it to the nearest or most optimal Service Connection, reducing latency. If it is not recognized, traffic may take a suboptimal path. Verifying that the application is correctly identified and that the Service Connection selection is optimal is key to ensuring performance.

Remote Networks use static routes to direct traffic. If internal subnet routes are missing or point to the wrong tunnel, internal application access fails even with a healthy BGP session on the Service Connection. Verifying static routes and route table entries is the logical next step to ensure internal traffic is steered correctly.

Lowering the tunnel interface MTU or clamping TCP MSS prevents oversized packets from being fragmented across the GlobalProtect tunnel, satisfying the requirement to mitigate fragmentation for mobile users. This keeps encapsulated packets within path MTU limits.

Decryption logs specifically record sessions that were decrypted and the policy that matched. If the user's session appears in the decryption logs, it confirms that SSL decryption was applied. Absence from these logs indicates the traffic was not decrypted, which can explain why a security policy did not block or inspect it.

GlobalProtect client settings in Panorama push DNS server addresses to the endpoint agent, so split-tunnel DNS queries for internal domains resolve against corporate resolvers. Configuring primary and secondary addresses under Network Settings satisfies the requirement that internal DNS resolution be used while users are connected through the GlobalProtect app.

Security Policy rules in Prisma Access can enforce URL Filtering and File Blocking for traffic from remote networks to the internet. Applying these profiles to the remote network zone ensures that web traffic is inspected and file downloads are controlled based on file type. This directly meets the requirement.

Configuring multiple IPSec tunnels to the same Remote Network location and enabling BGP allows for automatic failover. If the primary tunnel goes down, BGP will detect the failure and withdraw routes, causing traffic to use the secondary tunnel. This provides high availability without manual intervention. This is the recommended approach for redundant connectivity.

Tunnel All Traffic mode routes every packet from the GlobalProtect client into the tunnel, including internet-bound flows, so Prisma Access SWG can decrypt and inspect them. Split-tunnel modes would bypass inspection for directly routed traffic.

The URL Filtering log records each web request with its assigned category rating and the resulting allow or block action, giving the administrator the browsing detail required. It is the only log type that pairs URL category with user web activity.

QoS profiles on Remote Network connections are attached within Panorama's Remote Network configuration under Bandwidth Allocation and QoS, so branch traffic egressing that tunnel receives classification and priority. Applying it there ensures VoIP from the branch is marked and scheduled ahead of lower-priority flows.

Security policy rules in Prisma Access can match on destination IP addresses or address objects, so the administrator can define distinct rules for production and development subnets. This allows different inspection and action profiles per subnet while using a single Service Connection, satisfying the requirement without additional tunnels.

HIP Objects define the antimalware criteria, and HIP Profiles group them; referencing the profile in Security Policy rules enforces the check before access is granted. This satisfies the stem's requirement that endpoints have active, updated corporate antimalware prior to reaching internal applications.

The GlobalProtect portal authenticates users and returns the gateway configuration, directing each client to the nearest gateway based on geographic location. This satisfies the stem's requirement for user authentication plus location-based gateway assignment for remote workers.

Domain fronting hides the true SaaS destination inside TLS, so inline CASB cannot identify the application. An SSL Decryption policy using a Forward Trust certificate exposes the SNI and payload, enabling accurate application identification and control.

The Prisma Access plugin installs into Panorama and adds the Prisma Access configuration workflows, including service connections, remote networks and mobile users, to the Panorama interface. Without it, Panorama cannot manage or push Prisma Access configuration, so integration fails.

Traffic logs in Prisma Access record the session details including the source user, destination IP, and the egress interface or Service Connection used. Filtering by the mobile user and the internal application destination reveals whether the traffic is being routed via the Service Connection or dropped, directly answering the question.

This is correct because Prisma Access Remote Networks support specifying a primary and secondary location, and traffic steering can prefer the primary while allowing failover. Assigning locations by region keeps branch egress local for latency, and the secondary provides resilience if the primary location becomes unavailable, matching the stated requirements.

Cloud Identity Engine aggregates user identity from Microsoft Entra ID through a cloud-based connector, eliminating the need for on-premises or in-cloud User-ID agents. This directly satisfies the constraint of gathering identity efficiently without deploying physical agents inside the cloud network.

Service connections link Prisma Access to internal networks. If the service connection is down or routes are not advertised, mobile users cannot reach internal applications. Checking the status and routing ensures connectivity. This is critical because even if policies are correct, without a working service connection, access fails.

WildFire cloud analysis allows the file to be delivered to the user while a copy is forwarded to the WildFire cloud for sandbox analysis. In this scenario this meets the requirement that the download is not delayed while still analyzing the file for zero-day malware. If the analysis later determines the file is malicious, WildFire delivers a signature that the security processing node can use to block subsequent downloads and to generate alerts and WildFire logs for the original session.

Prisma Access Private Applications allow secure, clientless access to private web applications. They support SAML authentication, enabling contractors to authenticate via an identity provider without installing a GlobalProtect agent. The application is published through Prisma Access, and access is controlled by policies. This meets the requirement for agentless access on personal devices.

GlobalProtect app logs on the endpoint record the DNS server settings pushed by the gateway, including the DNS servers for the tunnel and any split-DNS configuration. They can show which DNS server the client is using for specific domains, helping to diagnose intermittent resolution failures due to misconfigured split-tunnel or split-DNS settings.

When SAML group mappings expire or the identity provider session times out, Prisma Access can no longer resolve the user's groups, so policies that reference those groups stop matching even though the tunnel remains up. This produces hourly access failures with an intact session and stable address. Refreshing group mapping or extending the session lifetime restores policy matching.

Security rules in Panorama govern inter-zone traffic, so a missing trust-to-untrust rule silently drops branch egress before any NAT or routing applies. Since Remote Networks traffic traverses the trust zone toward untrust, verifying this policy directly satisfies the stem's requirement to identify why external website access fails.

Prisma Access Insights surfaces real-time service health, cloud infrastructure status and tunnel state, satisfying the stem's requirement for operational visibility. It aggregates IPSec tunnel and infrastructure telemetry across all tenants, letting administrators detect outages and degraded connectivity without querying individual firewalls or Panorama directly.

Authentication succeeds because the Service Connection reaches the domain controller, but User-ID mapping requires the agent or Panorama to actively query that same controller for session data. Without polling across the Service Connection, or with User-ID traffic blocked, IP-to-username mapping never occurs for Remote Network users.