Prisma Access Administration And Operation

An administrator wants to ensure that mobile users comply with security posture policies before accessing corporate applications. Which TWO elements are required to enforce HIP (Host Information Profile) checking? (Choose two)

An administrator is troubleshooting a Prisma Access deployment where mobile users in the London region report intermittent inability to reach internal applications published through a Service Connection. The administrator suspects that the Service Connection is not advertising the correct routes to the Remote Network SPN. Which TWO items should the administrator verify on the Service Connection configuration? (Choose two.)

An administrator is troubleshooting a Prisma Access issue where mobile users are unable to access a newly deployed internal web application. The application is hosted in the data center and is reachable from the service connection. Security policy allows the traffic. Which log source should the administrator check first to determine whether the traffic is reaching the service connection?

Which TWO of the following are prerequisites for setting up Cloud Identity Engine (CIE) with Prisma Access?

An administrator is reviewing the Prisma Access deployment and notices that a Remote Network site has been offline for several hours. The administrator wants to quickly identify whether the issue is related to the IPsec tunnel or to the underlying ISP connectivity. Which Prisma Access dashboard should the administrator use to view the tunnel status and related alerts?

A Prisma Access administrator needs to publish an internal web application to Mobile Users through a Private Application. The application uses a hostname that is not resolvable by public DNS. The administrator wants Mobile Users' browsers to reach the app using its internal FQDN without exposing the app to the internet. What must be configured to achieve this?

You are troubleshooting a Mobile User connectivity issue where users cannot access internal resources. The Cloud Identity Engine (CIE) shows the user as authenticated, but the Security Policy log shows the traffic is dropped with 'policy-deny'. What is the most likely cause?

An administrator has deployed Prisma Access with a single Service Connection to an on-premises data center. Branch users at a Remote Network site report intermittent access to internal applications, while internet-bound traffic works reliably. The administrator suspects the Service Connection is the cause. Which action should the administrator take to confirm whether the Service Connection is the source of the problem?

An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?

A security administrator at a company using Prisma Access needs to ensure that only corporate-managed Windows devices running Windows 10 version 21H2 or later can access internal applications. The administrator has already configured a HIP profile that checks the OS version and a HIP object for the OS. Which additional component must be configured to enforce this requirement?

An administrator needs to ensure that mobile users connecting via Prisma Access resolve internal domain names using the corporate DNS servers rather than public resolvers. Where is this configured?

An administrator is configuring Remote Networks in Prisma Access for a branch office using Internet Key Exchange Version 2 (IKEv2). During the configuration in Panorama, which component must be deployed on the branch office router to ensure proper IPsec tunnel establishment with the Prisma Access Service Connections and Remote Networks nodes?

An administrator is configuring Prisma Access to enforce security policies for mobile users based on the user's department. The administrator wants to ensure that only members of the 'Finance' department can access a sensitive internal application. Which Prisma Access feature should the administrator use to dynamically assign users to a policy group based on their department attribute from the identity provider?

An administrator is deploying a new Prisma Access tenant with a single service connection to an on-premises data center. The security team requires that all traffic from remote network branch offices to the data center be inspected by Prisma Access security policy before reaching internal applications. The administrator configures the remote network and service connection, but branch users report they can reach internal applications directly without any security inspection. What is the most likely cause?

An administrator wants to inspect outbound web traffic from mobile users for malware and spyware using Prisma Access. Which security profile type must be attached to the Security policy rule?

An administrator needs to verify that a newly configured remote network in Prisma Access is operational and passing traffic. Which status indicator in the Prisma Access dashboard should the administrator check first to confirm the IPSec tunnel is established?

An administrator has just finished configuring a new Prisma Access tenant and wants to verify that Mobile Users can connect and that security policy is being applied. The administrator needs a high-level view of connected Mobile Users, their locations, and the applications in use. Which Prisma Access monitoring area should the administrator use?

Which THREE factors influence the selection of a Compute Location in a Prisma Access deployment?

An administrator is troubleshooting connectivity issues for a remote network connected to Prisma Access via IPsec VPN. Which TWO checks should be performed to verify tunnel health and status? (Choose two)

An administrator notices that Prisma Access mobile users in the EMEA region are being assigned IP addresses from the 10.20.0.0/16 pool, which overlaps with an internal subnet at 10.20.10.0/24 that users must reach. What should the administrator do in the Prisma Access mobile user configuration to avoid the conflict?

You are deploying Prisma Access and need to ensure that traffic from mobile users accessing the internet is inspected by a specific set of security profiles. Where should these profiles be applied?

An organization is migrating its identity provider integration to the Cloud Identity Engine (CIE) to support Prisma Access authentication and User-ID. When configuring the connection between CIE and the enterprise Active Directory, which component is required on-premises to sync directory objects securely without opening inbound firewall ports?

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

An administrator has configured Prisma Access to forward logs to an external SIEM using a HTTPS log forwarding profile. After a week, the SIEM shows no Prisma Access logs, but the Prisma Access dashboard shows traffic and threats. Which item should the administrator verify first?

A security administrator needs to quickly identify which users are consuming the most bandwidth through Prisma Access mobile user connections over the past 24 hours. Which Prisma Access monitoring dashboard or report should the administrator use?

An administrator is deploying Prisma Access for a new remote network site. The site requires access to both the internet and internal applications hosted in an on-premises data center. The administrator has configured a service connection to the data center. Which additional configuration is required to allow remote network users to access internal applications?

Which object type should be used to restrict access to a specific internal application for Remote Network users while ensuring the policy is scalable?

A security engineer is troubleshooting why a Prisma Access mobile user's traffic to a specific external website is being allowed despite a security policy rule that should block it. The rule is configured with a source user of 'domain\jdoe' and a destination of 'any', and the action is deny. The user is authenticated via GlobalProtect with User-ID enabled. What is the most likely reason the rule is not matching?

An administrator is reviewing the Prisma Access license and notices that the organization has purchased the Prisma Access for Networks license but not the Prisma Access for Users license. Which functionality is available with this license?

An administrator is reviewing the status of Remote Networks in Prisma Access and notices that an IPsec tunnel has failed to establish. Which THREE diagnostic steps or verifications should the administrator perform in Panorama or Prisma Access Insights? (Choose three)

When configuring a Remote Network (RN) connection to an on-premises data center, which parameter is required to ensure proper routing of internal traffic via the IPSec tunnel?

An administrator is onboarding a new remote network in Prisma Access and wants to verify that the tunnel is healthy after configuration. Which two status indicators should the administrator check in the Prisma Access status view to confirm the remote network tunnel is up? (Choose two.)

An administrator has deployed Prisma Access for a branch office remote network that must reach a SaaS application through a service connection. After committing the configuration, users report that traffic is being dropped at the remote network firewall with the message 'no matching service connection found.' The administrator verifies that the service connection is up and the SaaS application is in the correct region. What is the most likely cause?

An administrator is configuring security policies in Prisma Access and wants to ensure comprehensive protection against unknown threats and malware. Which TWO security profile types should be applied to outbound and internet-bound rules? (Choose two)

When configuring Security policy rules in Prisma Access, which THREE types of criteria can be used to control traffic traversing the cloud infrastructure? (Choose three)

An administrator needs to give the security team a single dashboard that shows which Prisma Access security policy rules are being triggered most frequently across all mobile users and Remote Networks over the last 30 days. Which Prisma Access reporting capability should the administrator use?

An administrator has configured a Service Connection in Prisma Access with BGP to advertise internal routes. After a configuration change, internal users can no longer reach resources in a specific subnet. The administrator verifies that the BGP session is established and that the subnet is advertised from the on-premises router. Which action should the administrator take to ensure that Prisma Access accepts and uses the advertised route?

What is the benefit of using Prisma Access for Remote Networks instead of traditional site-to-site VPNs?

An administrator is configuring Prisma Access to enforce security policy for Mobile Users. The administrator wants to ensure that traffic from Mobile Users is inspected for threats and that users are identified by their corporate credentials. Which TWO components must be configured to achieve this? (Choose two.)

An administrator is configuring Mobile Users in Prisma Access and needs to set up user authentication. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

Which tool provides end-to-end visibility into Prisma Access performance, user experience metrics, and digital experience monitoring (DEM)?

An administrator is troubleshooting a Prisma Access issue where mobile users in a specific region experience intermittent connectivity drops. The administrator observes that the GlobalProtect agent logs show repeated gateway selection changes. Which action should the administrator take to stabilize the connection?

A network administrator wants to enable User-ID for mobile users connecting via GlobalProtect in Prisma Access. Which component should be configured to map users to IP addresses when using the Cloud Identity Engine?

An administrator needs to provide access to a set of internal web applications for mobile users connected through Prisma Access. The applications are hosted in an on-premises data center and must be reachable only by authenticated users, with traffic inspected for threats. Which Prisma Access component should the administrator configure to enable this access?

When designing high availability and redundancy for Prisma Access Remote Networks, which THREE considerations or practices are essential? (Choose three)

An administrator notices that Remote Network (branch) traffic to SaaS applications is being backhauled through the corporate data center instead of breaking out locally at the Prisma Access node. The administrator wants branch traffic destined to trusted SaaS applications to egress directly from the Prisma Access service connection. Which Prisma Access capability should be used to accomplish this?

Which component in Prisma Access is responsible for performing decryption, content inspection, and threat prevention for mobile users?

When designing Security and Inspection Policies for Prisma Access, an administrator needs to ensure optimal performance and security coverage. Which THREE best practices should the administrator follow when implementing Security Policy rules in Panorama for Prisma Access? (Choose three)

When managing Security Policies in Prisma Access, which TWO components are essential to ensure that policies are correctly applied to traffic?

An administrator is setting up the Cloud Identity Engine (CIE) to support user mapping and authentication for Prisma Access. Which THREE components or steps are required for a successful CIE deployment? (Choose three)

An administrator needs to give a security operations analyst read-only access to Prisma Access logs and reports without allowing any configuration changes. Which Prisma Access administrative role should the administrator assign in the identity provider or Panorama?

An administrator needs to optimize mobile user traffic performance and reduce latency in Prisma Access. Which THREE features or configurations can be utilized to achieve this? (Choose three)

An administrator is configuring Prisma Access to provide secure internet access for mobile users. The organization requires that all traffic to known malicious domains be blocked, and that SSL decryption be performed for traffic to categories such as 'malware' and 'phishing' to inspect for threats. The administrator enables SSL decryption in the decryption policy for these categories. However, after testing, users can still access some known malicious sites without any block or decryption. What is the most likely reason?

An administrator has deployed Prisma Access with a single Remote Network SPN at a branch office in Frankfurt. Users complain that after a failover of the primary ISP link, all traffic to SaaS applications is being forced through the backup link even though the primary link is healthy again. The administrator wants Prisma Access to automatically restore the preferred path without manual intervention. Which feature should be configured?

What is the primary function of the GlobalProtect Portal in a Prisma Access deployment?

An administrator is reviewing the operational health and logs of Prisma Access. Which TWO monitoring tools or log types are available within Panorama for troubleshooting security events and traffic flows? (Choose two)

An administrator is deploying Prisma Access for a new Remote Network site that requires access to both the internet and internal applications. The administrator has already configured the Remote Network and Service Connection. Users report that internet access works, but internal application access fails. The administrator confirms that the Service Connection BGP session is established and advertising routes. Which configuration should the administrator verify next on the Remote Network?

An administrator is configuring a Prisma Access Service Connection for a data center that hosts both production and development workloads. The security team requires that mobile users accessing development subnets be inspected by a different security policy than those accessing production subnets, without deploying separate Service Connections. Which approach should the administrator take?

An enterprise using Prisma Access Mobile Users needs to enforce Host Information Profile (HIP) checks to ensure that endpoints have an active and updated corporate antimalware solution before granting access to internal applications. Which workflow must an administrator complete to successfully enforce this requirement?

An administrator is deploying a new Prisma Access tenant for a company with branch offices in North America and Europe. The security team requires that all branch traffic egress through a Prisma Access location in the same region as the branch to minimize latency, while still allowing failover to another region during an outage. Which Prisma Access configuration should the administrator implement?

An administrator is troubleshooting a Prisma Access mobile user who cannot access any internal applications. The administrator has verified that the GlobalProtect app shows a connected status and that the user's authentication is successful. Which two actions should the administrator take to identify the cause? (Choose two.)

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

An administrator is configuring Prisma Access to secure outbound internet traffic from a remote network site. The administrator wants to ensure that all traffic from the branch is inspected by Prisma Access security services, including threat prevention and URL filtering, before reaching the internet. Which Prisma Access component must be configured to direct branch traffic to the cloud security services?

An administrator needs to configure secure access for remote networks using dynamic routing (BGP). Where are the BGP peer parameters, local AS number, and peer AS configured in Prisma Access?

A security administrator notices that Prisma Access is not enforcing a URL Filtering profile for traffic from a specific Remote Network. The profile is applied in a security policy rule that matches the Remote Network's source zone. The administrator confirms the rule is present and enabled. What is the most likely cause?

A security team wants to ensure that all traffic from mobile users to sanctioned SaaS applications is inspected for data patterns while traffic to unsanctioned applications is blocked. Which Prisma Access policy type should the administrator configure to enforce this per-application control?

An administrator has deployed Prisma Access with a single service connection to an on-premises data center. Branch users at a remote network report that traffic to an internal application hosted behind the data center firewall is being dropped, even though Security policy allows it. The administrator confirms the remote network tunnel is up and the service connection is green. Which configuration element should the administrator verify to allow the branch-to-data-center traffic to traverse the Prisma Access infrastructure?

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

An administrator is configuring Prisma Access for a new remote network site. The site has a single ISP link and requires high availability for the IPSec tunnel to Prisma Access. The administrator wants to ensure that if the primary Prisma Access gateway becomes unavailable, the tunnel automatically fails over to a secondary gateway. Which feature should the administrator configure on the remote network device?

An administrator is reviewing Prisma Access logs to investigate a security incident. The administrator needs to identify which user accessed a specific malicious URL. Which log type in Prisma Access provides the user identity along with the URL and action taken?

Which TWO configuration steps are required to allow internet access for Remote Network users?