Certified Security Service Edge Engineer (SSE-Engineer) (SSE-Engineer) — Questions 226–278

Insight path quality monitoring measures latency, jitter and packet loss across the path between remote network locations and Prisma Access nodes, giving hop-level visibility. This directly satisfies the administrator's requirement to analyse path quality for the affected region's SaaS traffic.

IKE phase 1 failures are logged as system-level events, so Monitor > Logs > System filtered for IKE or IPsec captures the precise negotiation error, such as proposal mismatch or authentication failure. Tunnel status alone shows only up/down state, not the cause.

For mobile users to access on-premises applications via Service Connection, a Security Policy rule must allow traffic from the mobile user zone to the Service Connection zone. If this rule is missing or incorrect, traffic will be blocked. This is a common oversight and aligns with the symptoms.

'Gateway not found' typically indicates name resolution failure, so an nslookup against the portal-provided gateway FQDN confirms whether DNS returns a valid address. If resolution fails, the client cannot locate the gateway regardless of tunnel or certificate state.

Prisma Access advertises data centre subnets to the remote network through BGP; the Service Connection needs peer settings and export rules configured in Panorama. Without these, the tunnel shows Connected but no routes propagate, causing the reported routing failure.

Traffic logs in Prisma Access record all sessions and include details such as the security policy rule that matched, the action taken (allow/deny), and the reason for denial. Examining traffic logs will show if a security policy is blocking the connection to the private application, making it the correct log type for this troubleshooting.

Panorama > Cloud Services > Setup > Support exposes the Prisma Access cloud infrastructure Tech Support File generation, distinct from the managed firewall TSF. The stem specifies the cloud infrastructure scope, so this is the correct location rather than device-level support options.

The GlobalProtect app logs record tunnel state changes, including disconnects and reconnects. If the tunnel is flapping, these logs will show repeated disconnect and reconnect events with timestamps. This directly identifies tunnel instability, which matches the symptom of intermittent loss of access.

DNS Security profiles are created under Objects -> Security Profiles and enforced via Security policy rules.

App-ID policies naming specific internal applications enforce least-privileged access by identifying the actual application rather than the underlying subnet, preventing lateral movement to unrelated services sharing that network range. This satisfies the stem's requirement for mandatory ZTNA 2.0 configuration controlling private application access.

Compute locations must sit near the users and sites they serve, so the geographic spread of remote workers and branch offices directly drives placement. This satisfies the stem's compute-location factor by minimising latency and backhaul for the majority of traffic.

Panorama's Cloud Services status pages report per-region Prisma Access node health, capacity and infrastructure metrics for remote networks and mobile users, letting the administrator confirm whether the latency and disconnections originate from a degraded regional node.

Traffic logs in Prisma Access include the egress interface, which identifies the Service Connection used for the session. For a Remote Network, the log will show whether traffic egressed via the expected Service Connection or a suboptimal one. This directly verifies the egress point selection.

A remote network connection establishes an IPSec tunnel from the branch to the Prisma Access regional hub, directing all branch traffic through Prisma Access where security services are applied. This is the correct component for securing outbound internet traffic from a remote network site, as it ensures inspection by threat prevention and URL filtering.

WildFire submits downloaded executables and documents to a cloud-based behavioural sandbox, detonating them to observe malicious actions and identify previously unknown zero-day threats. This inline inspection within Prisma Access SWG satisfies the requirement to catch unknown malware.

Static routes on the remote network define how traffic is forwarded from the branch to Prisma Access. If a static route for the SaaS application's subnet is missing or incorrect, traffic will not be sent to the Service Connection. The administrator should verify that the remote network's configuration includes a route pointing to the Service Connection for the SaaS application's IP addresses. This step is crucial for ensuring proper traffic flow.

Distributing SPNs across North America, Europe and Asia places security processing within each region, so remote workers' traffic is inspected at the nearest node rather than backhauled to a central location. This directly satisfies the low-latency requirement by minimising geographic distance between user and processing point.

Panorama > Cloud Services > Status is the dedicated workspace aggregating Prisma Access infrastructure health, showing deployed Mobile User nodes and their operational state per region. Other Panorama areas cover policy or logs, not infrastructure status.

BGP peering parameters for Prisma Access remote networks are configured per remote network under Panorama's Cloud Services plugin, where the local AS number, peer AS, peer IP addresses and BGP timers are defined. This location satisfies the stem's requirement for dynamic routing configuration on a specific remote network.

SAML assertions carry NotBefore and NotOnOrAfter conditions. If the IdP and Prisma Access service nodes disagree on time beyond the tolerance window, Prisma Access rejects an assertion the IdP considered valid, producing exactly this split-log discrepancy.

Mobile users reach the data centre only when the Service Connection's internal subnet routes are advertised into the Mobile Users configuration. Without those routes in the Explicit Proxy or Split Tunnel settings, client traffic is never directed down the IPsec tunnel, so the tunnel being up is irrelevant.

Security rules are evaluated top-down, and the first match wins. If an earlier rule allows the traffic without a URL Filtering profile, the intended rule is never reached. This is the most common reason a profile appears not to be enforced despite an enabled rule existing lower in the rulebase.

A Service Connection in Prisma Access connects the Prisma Access infrastructure to a customer's data center or headquarters, allowing remote users to access internal applications without exposing them to the internet. It provides a secure, private connection and is the correct component for this scenario because it enables remote users to reach internal resources securely.

Prisma Access natively supports BGP over its IPsec tunnels, allowing dynamic route exchange with the corporate data centre without extra overlay protocols. This satisfies the stem's requirement for a natively supported dynamic routing protocol across the Service Connection.

In Prisma Access, threat prevention profiles are attached to security policy rules. The engineer should edit the security rule that permits the traffic and, under Actions, select the appropriate threat prevention profile in the Profile Setting. This applies the profile to all traffic matching the rule, both inbound and outbound, as long as the rule covers both directions. This is the correct method to enforce threat prevention.

Setting the profile to 'None' means the rule permits matching traffic but attaches no security profiles, so Antivirus, Anti-Spyware, Vulnerability Protection and WildFire inspection are all skipped. The traffic is allowed uninspected, explaining the observed bypass.

This is correct because Prisma Access supports multiple tunnels from a remote network to different service connections. By running BGP over these tunnels, the remote network can advertise its routes and learn Prisma Access routes. If the primary tunnel fails, BGP withdraws the routes, and traffic fails over to the backup tunnel automatically. This provides redundancy and automatic failover.

GlobalProtect resolves the closest Prisma Access gateway through cloud DNS, then applies regional gateway priority so European users land on European nodes and North American users on North American nodes. This satisfies the stem's geographic routing requirement automatically, without manual client configuration.

Prisma Access terminates mobile-user tunnels at redundant gateways distributed across multiple geographic regions, so a failed location or component fails over to another. This cloud-scale redundancy delivers the resilient connectivity and high availability the stem requires for mobile users.

In Prisma Access, when you configure a remote network, you specify the IP addresses or subnets that are used by the branch. These IP addresses are then available as source addresses in security policies. The remote network configuration defines the source IPs for traffic originating from that branch, allowing policy enforcement based on those addresses.

When DNS proxy is enabled, administrators can configure split DNS by adding internal domains and specifying the internal DNS servers. This allows the proxy to forward queries for those domains to the internal servers, while resolving other queries externally. This is the correct step to enable internal domain resolution.

Threat Prevention cannot inspect encrypted sessions, so a decryption policy that excludes or bypasses traffic leaves it uninspected. Verifying decryption ensures traffic is actually presented to the inspection engines, satisfying the requirement to confirm inspection is not bypassed.

Terminating redundant IPsec tunnels on separate CPE devices or diverse ISP links removes single points of failure, so Remote Network traffic survives a device or circuit outage. This directly satisfies the stem's redundancy and performance optimisation goal for Prisma Access connectivity.

SaaS security policies in Prisma Access are designed to identify sanctioned and unsanctioned SaaS applications and apply actions such as allow, block, or alert. This policy type provides the per-application control the team needs, letting them inspect sanctioned SaaS traffic for data patterns while blocking unsanctioned applications.

Explicit proxy authentication challenges and decryption profiles determine whether the proxy can complete its handshake with the client. Misconfigured profiles stall that exchange, producing timeouts, so inspecting them satisfies the stem's requirement to check areas causing connection timeout errors.

In Prisma Access, traffic from a remote network to a data center traverses the service connection only if the data center prefix is known to the remote network's routing table and advertised appropriately. The service connection advertises on-premises prefixes, and the remote network must accept them so the branch traffic is forwarded to the service connection rather than dropped. Verifying both the advertised routes and the remote network route table is the correct troubleshooting step.

In Prisma Access, to enforce web filtering, a URL Filtering profile must be attached to the security policy rule that allows web traffic. Without a URL Filtering profile, the rule simply allows all web traffic without inspecting or blocking based on URL categories. The SWG license enables the service, but the actual blocking requires the profile. This is the most likely missing configuration that allows malicious websites to be accessed.

User-ID logs contain information about user identification events, including group mapping from sources like Active Directory or LDAP. These logs show which groups a user belongs to and can help diagnose why group-based policies are not matching. Reviewing User-ID logs is the correct way to verify that the user-to-group mapping is functioning as expected and that the user is associated with the correct groups.

IPsec tunnel flaps often result from mismatched IKE or IPsec crypto profiles between peers. The branch CPE and Prisma Access service connection must have identical proposal settings (encryption, authentication, DH group, lifetime). Checking both sides ensures they match. If they differ, the tunnel will fail to establish or will renegotiate frequently, causing intermittent connectivity. This is the correct component to verify.

Group Mapping Settings in Panorama pull group memberships from the Cloud Identity Engine, which is what group-based policy enforcement requires. Without this mapping, Prisma Access receives user identity but cannot resolve the directory groups referenced in security rules, so the stem's group-based enforcement constraint fails.

Panorama records configuration push attempts and their failures under Job Status, with detailed errors in the Config and System logs. This satisfies the need to locate push failure details by pointing to the specific monitoring views.

A consistent 30-minute drop pattern strongly suggests a session or idle timeout mismatch on the service connection or IPSec tunnel. Checking these timers against the observed interval directly tests whether the infrastructure is tearing down idle sessions. Since tunnels and routes are confirmed up, timer expiration is the most likely explanation for periodic, predictable drops affecting multiple users.

Prisma Access supports configuring multiple IPSec tunnels from a remote network to different Prisma Access gateways for redundancy. The remote network device can use tunnel monitoring to detect failure of the primary tunnel and automatically fail over to the secondary tunnel. This provides high availability even with a single ISP link, as long as the gateways are reachable. The administrator should configure the secondary gateway as a backup and enable failover based on tunnel monitoring.

ZTNA depends on GlobalProtect establishing the tunnel and reporting HIP data, since application access policies are matched against HIP profiles. Confirming tunnel state and current HIP ensures the endpoint meets posture conditions before investigating policy or connector faults.

CASB inline enforcement requires visibility into the encrypted payload to match file-level attributes; without SSL decryption, the firewall sees only metadata and cannot identify the file upload, so the inline block action never triggers despite the correct application being matched.

URL filtering logs in Prisma Access record the URL accessed, the category, the action taken (allow, block, alert), and the user identity if User-ID is enabled. This log type is specifically designed to track web activity and is the best source to identify which user accessed a malicious URL. It provides the necessary details for security incident investigation.

MFA is enforced by the Identity Provider (IdP) that Prisma Access integrates with for SAML authentication. When users authenticate, the IdP challenges them for a second factor. Prisma Access relies on the IdP to perform MFA and then accepts the SAML assertion. Thus, the IdP is responsible for MFA enforcement.

A Data Filtering profile inspects traffic for sensitive data patterns and file types, blocking uploads of proprietary content to unsanctioned cloud storage. Applied to Security Policy rules, it satisfies the requirement to prevent data exfiltration via unauthorised applications.

GlobalProtect Client Settings in Panorama determine which portals, gateways and agent configurations are pushed to endpoints; misassignment prevents clients from connecting. Inspecting them satisfies the stem's requirement to check the configuration components governing mobile user connectivity.

Toggling Internet Access within the Remote Network configuration routes that network's traffic to the internet through the SSE platform rather than only to private resources. This satisfies the requirement to permit internet access for Remote Network users.

Traffic log session details expose the App-ID Prisma Access assigned to each flow, letting the administrator compare detected application against expectation. Packet captures supplement this when the signature decision needs deeper inspection, directly satisfying the requirement to inspect live App-ID identification.

Traffic logs in Prisma Access record session details including source, destination, application, and the policy action (allow/deny). They are the primary source for determining whether a security policy is blocking traffic. Since the tunnel is up and the service IP is reachable, the next logical step is to check if sessions are being denied. Traffic logs will show the rule that matched and the reason for denial, directly answering the question.

Schedule Objects define reusable time windows, such as working hours excluding a lunch interval, and attach directly to Security Policy rules. This satisfies the stem's requirement for time-based enforcement, letting the same Gambling URL category be blocked during working hours yet permitted during lunch breaks without duplicating rules.