CCNA Prisma Access Administration And Operation Questions

The GlobalProtect agent must gather host data such as patch level, antivirus and disk encryption, then forward it to the gateway; without enabling HIP data collection on the agent, no profile exists for the gateway to evaluate against policy.

Redistribution settings determine whether internal prefixes learned from the on-premises routing domain are propagated to Prisma Access. If redistribution is misconfigured or filtered, some subnets may be advertised intermittently or not at all. This directly affects which internal applications mobile users can reach through the Service Connection, matching the reported symptom.

The Prisma Access monitoring interface provides traffic logs that show whether traffic was allowed or denied, and they include details such as the source, destination, and the service connection involved. Filtering by the application and service connection helps determine if the traffic reached the service connection and was forwarded or dropped. This is the most direct way to trace the traffic path within Prisma Access.

Cloud Identity Engine consumes user and group data from an external directory, so an IdP integration such as Azure AD or Okta must exist first. Without that identity source, CIE has no directory to synchronise, making this a genuine prerequisite.

Prisma Access Insights provides a centralized view of Remote Network tunnel status, alerts, and health metrics. It is the appropriate dashboard to quickly determine if the IPsec tunnel is down or if there are ISP-related issues. This directly addresses the administrator's need to identify the cause of the offline site.

Private Applications are defined with the internal FQDN or IP, and Mobile Users must be able to resolve that FQDN. Because public DNS will not resolve an internal name, the administrator must ensure the GlobalProtect client uses a DNS server that can resolve the internal name, often via the portal/agent DNS configuration or split-DNS, so the browser connects to the Private Application tunnel.

Authentication succeeded at the identity layer, so the drop originates in policy evaluation. A source zone mismatch or user-group mapping that does not match the incoming flow means no rule permits the traffic, producing the policy-deny entry despite CIE reporting the user as authenticated.

Prisma Access Insights provides Service Connection health including tunnel state and BGP session status. If the BGP session is down or flapping, internal routes will not be advertised, causing intermittent access to internal applications. This directly confirms whether the Service Connection is the source of the problem.

Remote network configuration lives under Panorama's Cloud Services plugin, at Configuration > Remote Networks. This is the central management plane where branch onboarding, IPsec termination settings and licensing are defined before push to Prisma Access.

A Security policy rule with a HIP profile condition enforces the requirement. The HIP profile checks the OS version, and the rule allows traffic only when the HIP check passes. This directly ties the HIP profile to the security policy, ensuring that only compliant devices access internal applications. Without this rule, the HIP profile alone does not enforce access control.

Client Settings under Mobile Users in Panorama's Cloud Services configuration pushes DNS server addresses and suffix to GlobalProtect mobile users, forcing internal name resolution through corporate resolvers. This satisfies the stem's constraint that mobile users must not fall back to public DNS.

IPsec IKEv2 requires the branch router to present a routable public IP for peer identification and a pre-shared key that exactly matches the IKE gateway defined in Panorama, satisfying the authentication and reachability constraints needed for tunnel establishment with Prisma Access nodes.

The Cloud Identity Engine (CIE) ingests user and group information from identity providers and can map SAML attributes to Prisma Access policy groups. This allows dynamic assignment based on department attributes, enabling precise policy enforcement for the Finance department without on-premises infrastructure.

In Prisma Access, remote networks only use service connections that are explicitly associated with them. If the administrator does not associate the service connection with the remote network, traffic from the branch to the data center will not be routed through Prisma Access for inspection; it may instead use local internet breakout or direct routes. Associating the service connection ensures traffic is forwarded to the data center via the secure tunnel and inspected by security policy.

Antivirus and Anti-Spyware profiles are the only profile types that scan traffic streams for malware and spyware signatures. Attaching them to the Security policy rule satisfies the requirement to inspect outbound web traffic from mobile users through Prisma Access.

The Prisma Access dashboard includes a Health section that displays the status of remote networks, including whether the IPSec tunnel is up and whether traffic is flowing. This is the primary place to verify tunnel establishment. The administrator can see green/red indicators and details about the tunnel state, making it the first check for operational status.

Prisma Access Insights is the monitoring and analytics application that aggregates telemetry from Prisma Access and presents dashboards for Mobile Users, Remote Networks, Service Connections, and overall health. It gives the high-level view of connected users, locations, and application usage that the administrator needs to verify the new tenant.

Network performance is a key factor.

Panorama's Cloud Services status page reports the live IPsec tunnel state for each remote network, including IKE and IPSec security association status. This directly satisfies the requirement to verify tunnel health and status for the remote network connected via IPsec VPN.

Prisma Access mobile user address pools must not overlap with internal subnets that clients need to reach, because overlapping routes create ambiguity in the GlobalProtect routing table. Reconfiguring the pool to a unique, non-overlapping range and pushing the change resolves the conflict and allows users to reach the internal 10.20.10.0/24 resources normally.

Security profiles attach to Security Policy rules, so placing them in the Panorama rule that matches mobile-user traffic ensures that traffic is inspected by exactly those profiles. The constraint is profile enforcement during policy evaluation, which only rule-level attachment satisfies.

The Cloud Identity Engine Agent runs on-premises and initiates outbound connections to CIE, synchronising Active Directory objects without requiring any inbound firewall ports to be opened. That outbound-only design is precisely what the scenario's security constraint demands.

Cloud Identity Engine syncs Active Directory groups, so the Security rule's Source User field must reference the fully qualified group name CIE provides; this lets policy match users by synced group membership rather than individual accounts.

Log forwarding profiles must be attached to security policy rules for the relevant log types to be sent externally. If the profile is not attached, logs remain in the local data lake and are visible in dashboards but never forwarded to the SIEM. This directly explains why the dashboard shows activity while the SIEM receives nothing.

The User Activity report in Prisma Access Insights provides detailed information about user sessions, including bandwidth consumption per user. It allows administrators to sort and filter by bandwidth usage over a specified time period, such as the past 24 hours, making it the appropriate tool to identify top bandwidth consumers among mobile users.

For remote network users to access internal applications, Prisma Access must know the routes to those subnets. The service connection must advertise the internal subnets from the data center to Prisma Access. This enables Prisma Access to route traffic from the remote network to the data center. Without these routes, traffic cannot reach internal applications.

Address objects and Address Groups let you define the internal application's IPs once, then reference that group across policies. This satisfies the scalability constraint: adding or changing application subnets updates every dependent rule automatically, rather than editing each policy individually.

Prisma Access evaluates security policy rules top-down and stops at the first match. If an allow rule earlier in the rulebase matches the same traffic, the deny rule for the specific user will never be evaluated. The administrator should check rule order and ensure the deny rule is above any broader allow rules that could match the user's traffic. This is a common cause of unexpected allows.

The Prisma Access for Networks license provides remote network connectivity for branch offices, allowing them to connect to Prisma Access via IPSec tunnels. This license is specifically designed for site-to-site connectivity and does not include mobile user entitlements. It enables branch traffic to be secured and routed through the Prisma Access infrastructure.

IPsec establishment requires matching peer identities; if Panorama's configured peer public IP differs from the branch router's actual public IP, IKE negotiation fails. Verifying this match directly addresses the tunnel failure described in the stem.

Internal subnets reach the tunnel only if the remote network knows where to send them. Advertising them via BGP peering with the on-premises router, or defining static routes for those subnets, populates the routing table so traffic is steered into the IPSec tunnel rather than the default path.

The remote network status view displays the IPSec tunnel state for each onboarded site. A connected state confirms that IKE and IPSec negotiations succeeded and the branch firewall established the tunnel to the correct service connection, which is the primary indicator that the remote network is operational.

Prisma Access requires an explicit association between each remote network and the service connections it may use. Without this association, the cloud infrastructure cannot map traffic from that remote network to a service connection, producing the 'no matching service connection found' message. The administrator must edit the remote network configuration and add the service connection under the appropriate association setting.

Vulnerability Protection profiles inspect traffic for exploits targeting known software flaws, blocking attempts to leverage unpatched services. This satisfies the requirement for comprehensive protection against unknown threats by detecting anomalous exploit patterns, complementing anti-malware scanning on outbound and internet-bound rules.

Security policy rules match traffic on source and destination security zones, which identify the origin and target segments of the connection. Zones are one of the three supported match criteria, letting policy control traffic traversing the cloud infrastructure.

Prisma Access includes predefined reports that summarize security policy rule usage, showing which rules are hit most often. This directly provides the requested 30-day view across mobile users and Remote Networks, giving the security team a single dashboard of rule frequency without custom log queries.

BGP import/export rules on the Service Connection control which routes are accepted and advertised. If the specific subnet is filtered out by an import rule, Prisma Access will not install the route even though the BGP session is up. Checking these rules ensures the advertised route is accepted and used.

Prisma Access routes Remote Network traffic through its security cloud, where a single policy set is enforced and inspected. This removes the per-tunnel policy sprawl of traditional site-to-site VPNs, satisfying the requirement for consistent, centrally managed enforcement across all sites.

User-ID and authentication profiles are needed to map Mobile Users to corporate identities, enabling user-based security policy. Without User-ID, policies can only match on IP or other non-user criteria, failing the requirement to identify users by corporate credentials. This component is essential for the scenario.

LDAP directory authentication is natively supported for GlobalProtect mobile users in Prisma Access, letting the administrator validate credentials against an existing directory service. It integrates directly with the portal and gateway authentication profiles without additional brokers.

Prisma Access ADEM delivers synthetic and real-user monitoring across the full traffic path, capturing hop-by-hop network telemetry, application response times and endpoint experience metrics. This satisfies the stem's demand for end-to-end visibility plus DEM, which basic health dashboards or log-only tools cannot provide.

Restricting advertised gateways to the user's region and setting a clear primary gateway reduces unnecessary gateway switching. The agent selects gateways based on priority and response time; limiting options and defining priority stabilizes selection. This directly addresses the intermittent drops caused by repeated selection changes.

Configuring Cloud Identity Engine settings in Panorama syncs directory services and maps users to IP addresses for GlobalProtect mobile users in Prisma Access. This satisfies the User-ID requirement, since CIE supplies the user-to-IP mapping that the firewall consumes.

Service Connections link Prisma Access to the customer's internal network, allowing mobile users and remote networks to reach internal applications. Combined with security policy and threat inspection, this enables authenticated mobile users to access on-premises web applications securely. It is the correct component for extending internal access to Prisma Access.

Running BGP over the IPsec tunnels lets Remote Networks advertise and learn routes dynamically, so traffic reroutes automatically when a tunnel fails. This removes the need for manual or static failover, directly satisfying the stem's high availability and redundancy requirement.

Local Breakout on a Remote Network allows the branch firewall (the Prisma Access-managed IPSec tunnel endpoint) to send selected traffic directly to the internet instead of through the Service Connection. Using an Application filter, the administrator can permit SaaS applications to egress locally while still forwarding other traffic through the corporate data center.

Compute Locations host the security processing nodes that mobile users' tunnels terminate on, so decryption, content inspection and threat prevention execute there. The constraint is inspection of mobile-user traffic, which requires the compute node rather than management or portal components.

Security Profiles attached to allow rules provide Antivirus, Anti-Spyware and Vulnerability Protection scanning, so permitted traffic is still inspected. This satisfies the best-practise requirement for security coverage, since allow rules without profiles would pass traffic uninspected.

Address objects and tags define the precise source and destination criteria that Prisma Access security policies match against, ensuring rules apply only to intended traffic. Without them, policy scope remains undefined, so traffic cannot be correctly classified or enforced — satisfying the stem's requirement that policies be correctly applied.

The Directory Service connector syncs users and groups from Active Directory into Cloud Identity Engine, providing the identity data Prisma Access needs for user mapping. This satisfies the stem's requirement for a required CIE deployment component.

Prisma Access supports role-based access control where an administrator can be granted read-only visibility into logs and reports without configuration rights. Assigning such a role satisfies the requirement that the analyst review logs and reports while being unable to modify policies, objects, or Prisma Access settings.

Split tunnelling sends non-corporate and high-bandwidth traffic such as video streaming straight to the internet, bypassing the Prisma Access inspection path. This removes that traffic from the tunnel, cutting round-trip latency and freeing tunnel capacity, directly satisfying the stem's goal of optimising mobile user performance.

In Prisma Access, SSL decryption alone does not block malicious sites; it only decrypts traffic for inspection. To block known malicious domains, a URL filtering profile must be applied to the security policy rule that permits the traffic. If the URL filtering profile is missing or not attached to the rule, the traffic will be decrypted but not blocked. The administrator must ensure the security policy rule includes the URL filtering profile configured to block malicious categories.

Path quality monitoring continuously probes each ISP link and, when the primary link's metrics recover, triggers failback so the preferred path is restored automatically. This directly addresses the described symptom where traffic remains on the backup link after the primary ISP recovers, and it requires no manual administrator action.

The GlobalProtect Portal is the initial endpoint users connect to; it authenticates them, delivers the agent installer, and returns the list of available gateways. Hosting the agent software and gateway lists is therefore its primary function in a Prisma Access deployment.

Traffic and Threat logs are native Panorama log types that record session flows and security event matches from Prisma Access. They give the administrator the flow-level and threat-level visibility the stem requires for troubleshooting security events and traffic flows.

Remote Networks use static routes to direct traffic. If internal subnet routes are missing or point to the wrong tunnel, internal application access fails even with a healthy BGP session on the Service Connection. Verifying static routes and route table entries is the logical next step to ensure internal traffic is steered correctly.

Security policy rules in Prisma Access can match on destination IP addresses or address objects, so the administrator can define distinct rules for production and development subnets. This allows different inspection and action profiles per subnet while using a single Service Connection, satisfying the requirement without additional tunnels.

HIP Objects define the antimalware criteria, and HIP Profiles group them; referencing the profile in Security Policy rules enforces the check before access is granted. This satisfies the stem's requirement that endpoints have active, updated corporate antimalware prior to reaching internal applications.

This is correct because Prisma Access Remote Networks support specifying a primary and secondary location, and traffic steering can prefer the primary while allowing failover. Assigning locations by region keeps branch egress local for latency, and the secondary provides resilience if the primary location becomes unavailable, matching the stated requirements.

Service connections link Prisma Access to internal networks. If the service connection is down or routes are not advertised, mobile users cannot reach internal applications. Checking the status and routing ensures connectivity. This is critical because even if policies are correct, without a working service connection, access fails.

'Gateway not found' typically indicates name resolution failure, so an nslookup against the portal-provided gateway FQDN confirms whether DNS returns a valid address. If resolution fails, the client cannot locate the gateway regardless of tunnel or certificate state.

A remote network connection establishes an IPSec tunnel from the branch to the Prisma Access regional hub, directing all branch traffic through Prisma Access where security services are applied. This is the correct component for securing outbound internet traffic from a remote network site, as it ensures inspection by threat prevention and URL filtering.

BGP peering parameters for Prisma Access remote networks are configured per remote network under Panorama's Cloud Services plugin, where the local AS number, peer AS, peer IP addresses and BGP timers are defined. This location satisfies the stem's requirement for dynamic routing configuration on a specific remote network.

Security rules are evaluated top-down, and the first match wins. If an earlier rule allows the traffic without a URL Filtering profile, the intended rule is never reached. This is the most common reason a profile appears not to be enforced despite an enabled rule existing lower in the rulebase.

SaaS security policies in Prisma Access are designed to identify sanctioned and unsanctioned SaaS applications and apply actions such as allow, block, or alert. This policy type provides the per-application control the team needs, letting them inspect sanctioned SaaS traffic for data patterns while blocking unsanctioned applications.

In Prisma Access, traffic from a remote network to a data center traverses the service connection only if the data center prefix is known to the remote network's routing table and advertised appropriately. The service connection advertises on-premises prefixes, and the remote network must accept them so the branch traffic is forwarded to the service connection rather than dropped. Verifying both the advertised routes and the remote network route table is the correct troubleshooting step.

Group Mapping Settings in Panorama pull group memberships from the Cloud Identity Engine, which is what group-based policy enforcement requires. Without this mapping, Prisma Access receives user identity but cannot resolve the directory groups referenced in security rules, so the stem's group-based enforcement constraint fails.

Prisma Access supports configuring multiple IPSec tunnels from a remote network to different Prisma Access gateways for redundancy. The remote network device can use tunnel monitoring to detect failure of the primary tunnel and automatically fail over to the secondary tunnel. This provides high availability even with a single ISP link, as long as the gateways are reachable. The administrator should configure the secondary gateway as a backup and enable failover based on tunnel monitoring.

URL filtering logs in Prisma Access record the URL accessed, the category, the action taken (allow, block, alert), and the user identity if User-ID is enabled. This log type is specifically designed to track web activity and is the best source to identify which user accessed a malicious URL. It provides the necessary details for security incident investigation.

Toggling Internet Access within the Remote Network configuration routes that network's traffic to the internet through the SSE platform rather than only to private resources. This satisfies the requirement to permit internet access for Remote Network users.