CCNA Prisma Access Services Questions

To enable SSL decryption for mobile users, you must configure an SSL Decryption policy within the Mobile Users policy rules. This policy defines which traffic to decrypt based on source, destination, and other criteria. Without this policy, SSL traffic will not be decrypted, and SWG features like URL filtering and threat prevention will not function on encrypted traffic.

Prisma Access Cloud Management provides a Decryption policy under Security Services where administrators can create rules to decrypt SSL traffic. The policy can match on URL categories, source users, and other criteria, and supports exemption lists for categories that should not be decrypted. This is the correct location to enforce selective SSL decryption for mobile users.

Monitor → Logs → Authentication in Panorama records SAML assertion failures and IdP connectivity events for Prisma Access mobile users, directly satisfying the requirement to verify authentication timeouts. Unlike system or traffic logs, this log type captures the identity-provider exchange, letting the administrator confirm whether Microsoft Entra ID responses are reaching the gateway.

A service connection is the component that lets Prisma Access infrastructure reach private applications in a data center or headquarters. In this scenario the branch traffic arrives at a mobile user location and must then be forwarded internally, so the service connection provides the IPsec tunnel and the associated routing to the data center subnets. Without it, the mobile user location has no path to the internal application, and the traffic would be dropped or sent to the internet.

This is correct because Prisma Access provides a built-in DNS proxy that can resolve DNS queries for mobile users. By configuring the mobile users' DNS server to point to the Prisma Access DNS proxy IP and enabling the DNS proxy feature, all DNS queries from mobile users are sent to and resolved by Prisma Access, allowing for DNS security policies to be applied.

Firewall as a Service provides Layer 3/4 inspection between virtual networks and cloud environments connected through Prisma Access, satisfying the east-west traffic inspection requirement. It enforces security policy on inter-VNet and inter-cloud flows that would otherwise bypass inspection.

IPsec VPN tunnels terminate from the branch router or firewall directly into Prisma Access Remote Networks, which is the supported onboarding method for physical branch sites. This satisfies the requirement for a secure, encrypted connection over the public internet without dedicated circuits.

Pushing configuration to Prisma Access requires the Panorama Administrator role combined with Cloud Services plugin permissions, which grant access to the cloud management components. Without those plugin permissions, the administrator cannot commit changes to the cloud infrastructure.

The Data Filtering log records matches for data filtering and CASB inline policies, including the SaaS application, the matched rule, and the action taken such as alert or block. In this scenario it is the correct place to confirm whether the CASB policy matched the SaaS application and enforced the expected DLP action. If the log shows the file or data pattern was detected but the action differs from what was configured, the engineer can then inspect the rule order and profile settings.

Prisma Access supports multiple IPsec tunnels from a remote network to the same service connection, each originating from a different public IP. This provides redundancy because if one tunnel fails, traffic can fail over to the other tunnel. The remote network's two static public IPs allow the engineer to configure two separate tunnels, and Prisma Access will accept both as part of the same remote network configuration.

Prisma Access mobile users are assigned to a region based on their location or configuration. If some users connect through a region that lacks a service connection to the remote network, they cannot reach the application. Others using a region with the service connection succeed. This explains the partial failure.

Prisma Access Insights delivers real-time operational dashboards covering mobile user connections, bandwidth consumption per region and tunnel status. It is the dedicated monitoring service for Prisma Access, directly satisfying the administrator's requirement for these specific live metrics.

Inline CASB inspects the SaaS application session itself, so policy can distinguish operations within a sanctioned tenant — permitting viewing or download while blocking uploads — rather than merely allowing or denying the whole application by URL category.

Client-less VPN renders access through a browser, requiring no GlobalProtect agent installation. This satisfies the constraint that contractors use managed or unmanaged devices where agent deployment is impossible, while still enforcing least-privilege, identity-based access policies.

GlobalProtect mobile users in Prisma Access can authenticate directly against external RADIUS and LDAP servers, which Prisma Access queries natively without additional brokers. This satisfies the stem's requirement for natively supported authentication methods for mobile users.

Specifying the BGP peer AS number and peering IP addresses enables dynamic route exchange between the Service Connection and the corporate data centre. This satisfies the Service Connection configuration requirement, allowing Prisma Access to learn and advertise routes over the IPSec tunnel.

Seamless tunnel reconnection preserves the tunnel and security associations while the underlying transport changes, letting GlobalProtect re-establish rapidly as users roam between Wi-Fi and cellular. 'Always On' keeps the tunnel enforced, satisfying the stem's session-persistence requirement.

User-ID and group mapping are foundational for ZTNA 2.0, as they allow policies to be based on user identity and group membership. This ensures that only authorized users can access specific private applications, aligning with least-privilege principles and enabling continuous trust verification through identity context.

IPsec crypto profiles and tunnel parameters define the IKE and ESP encryption, authentication and lifetime settings both peers must match. Prisma Access requires these to negotiate the branch tunnel, satisfying the requirement for a secured connection to the cloud security backbone.

HIP checks collect endpoint posture data such as domain membership and registry keys, letting Prisma Access apply different security policies to managed corporate laptops versus unmanaged contractor devices. This satisfies the requirement to distinguish endpoint ownership during connection, since GlobalProtect reports host attributes the gateway evaluates before granting access.

Prisma Access SSL Decryption policies allow administrators to define rules that bypass decryption for specific URL categories, such as financial services or healthcare. This enables threat inspection for most traffic while respecting privacy regulations for sensitive sites. The no-decrypt rule ensures that traffic to those categories is not decrypted but can still be logged or subject to other controls. This is the standard approach for balancing security and privacy.

Continue is a configurable URL Filtering action that permits the request while logging it, unlike block or alert. It satisfies the stem's requirement to identify actions available within a Prisma Access URL Filtering profile for high-risk categories.

Vulnerability Protection profiles detect and block exploits targeting software flaws, such as buffer overflows and code execution attempts. Attaching them to Security Policy rules across all zones satisfies the stem's requirement for comprehensive threat prevention.

Anti-Spyware signatures identify and block known command-and-control traffic, while Vulnerability Protection profiles detect and stop exploit attempts against vulnerable services in real time. Applying both satisfies the stem's requirement to block C2 and exploits dynamically on outbound remote-network traffic.

Prisma Access can insert specific HTTP headers (such as Restricted-Access-Current-Tenant) into outbound requests to cloud services, forcing corporate tenants only.

A Threat Prevention profile on the Security Policy rule inspects traffic for vulnerabilities, spyware, and command-and-control activity. It is essential for threat inspection. Without it, malicious content might pass. Thus, it is required alongside URL Filtering to meet the requirement of inspecting for threats.

Prisma Access supports SAML attributes to dynamically assign users to groups based on IdP assertions. These groups can be used directly in security policies, enabling granular control without separate portals or gateways. This leverages existing SAML integration and is the most efficient method for policy differentiation.

This is correct because to inspect web traffic for threats, you must attach a threat prevention profile to the security policy rule that permits the traffic. The profile includes antivirus, anti-spyware, and vulnerability protection, which detect and block threats. Without it, traffic may be allowed without inspection, violating the requirement.

Dynamic routing across redundant IPsec tunnels requires BGP peering established over both tunnels to the Prisma Access service node, allowing the CPE router to learn and fail over routes automatically. This satisfies the high-availability requirement for the Remote Network location.

HIP Match logs are generated specifically when host information profile data changes or a device fails a compliance check, capturing the endpoint's posture state. This directly satisfies the stem's requirement to record HIP change and compliance failure events, unlike traffic, threat, or system logs.

GlobalProtect HIP profiles collect endpoint antivirus presence and definition update status, letting Prisma Access ZTNA deny access when signatures are missing or stale. This satisfies the endpoint hygiene verification requirement before internal applications are reached.

The GlobalProtect app collects Host Information Profile data from the endpoint, reporting disk encryption status and running endpoint protection agents. Prisma Access evaluates this HIP report before tunnel establishment, enforcing ZTNA 2.0 posture checks for remote mobile users.

This is correct because in Prisma Access, to route specific private IPs from mobile users through a service connection, you configure static routes on the service connection and enable advertisement to mobile users. This ensures traffic to 10.10.10.50/32 is sent over the service connection for inspection, while other traffic follows the default internet path.

Inline CASB sits in the data path, so it inspects traffic in real time and blocks uploads as they occur, satisfying the stem's comparison against out-of-band SaaS Security API, which only detects via API polling after the fact. This inline enforcement is the axis of difference.

Periodic HIP re-evaluation plus app-connector telemetry continuously revalidates user identity and device posture throughout the session, not just at login. This satisfies ZTNA 2.0's continuous trust verification requirement for mobile users reaching internal private applications.

DNS Security continuously analyses DNS queries and applies predictive analytics to block newly registered malicious domains at resolution time, satisfying the requirement for automatic blocking without manual signature updates. It delivers real-time domain and IP threat intelligence to Prisma Access, unlike static URL filtering or scheduled signature feeds.

The System log records GlobalProtect and ZTNA tunnel lifecycle events, including connection attempts, tunnel establishment failures, and authentication timeouts. It captures the gateway selection and HIP-related errors that mobile users encounter, directly satisfying the stem's requirement to diagnose tunnel establishment alongside authentication problems.

A Service Connection is required to connect Prisma Access to the corporate network or data center where private applications reside. Without it, mobile users cannot reach private applications through Prisma Access. This configuration ensures that traffic to private applications is routed through Prisma Access for inspection and policy enforcement.

GlobalProtect establishes a tunnel from the endpoint to the Prisma Access security processing node, which then inspects all traffic including web traffic for threats and URL filtering. In this scenario it is the simplest deployment because the GlobalProtect app handles the connection and no per-endpoint proxy configuration or trust certificate is needed for basic inspection. It also covers all traffic from the endpoint, not only browser web traffic, meeting the requirement to inspect all web traffic.

Shadow IT discovery identifies unsanctioned SaaS applications traversing Prisma Access and assigns risk scores, giving the administrator visibility needed to govern file-sharing and collaboration tools. It satisfies the granular control requirement by surfacing unapproved apps for policy action.

Service connections in Prisma Access must be associated with the locations where mobile users connect. If the service connection is not linked to the correct locations, mobile users' traffic will not be routed to the on-premises data center. This association is configured in the service connection settings, and verifying it ensures that users in those locations can access private applications through the service connection.

Security Policy rules in Prisma Access can enforce URL Filtering and File Blocking for traffic from remote networks to the internet. Applying these profiles to the remote network zone ensures that web traffic is inspected and file downloads are controlled based on file type. This directly meets the requirement.

Tunnel All Traffic mode routes every packet from the GlobalProtect client into the tunnel, including internet-bound flows, so Prisma Access SWG can decrypt and inspect them. Split-tunnel modes would bypass inspection for directly routed traffic.

The URL Filtering log records each web request with its assigned category rating and the resulting allow or block action, giving the administrator the browsing detail required. It is the only log type that pairs URL category with user web activity.

The GlobalProtect portal authenticates users and returns the gateway configuration, directing each client to the nearest gateway based on geographic location. This satisfies the stem's requirement for user authentication plus location-based gateway assignment for remote workers.

Domain fronting hides the true SaaS destination inside TLS, so inline CASB cannot identify the application. An SSL Decryption policy using a Forward Trust certificate exposes the SNI and payload, enabling accurate application identification and control.

Cloud Identity Engine aggregates user identity from Microsoft Entra ID through a cloud-based connector, eliminating the need for on-premises or in-cloud User-ID agents. This directly satisfies the constraint of gathering identity efficiently without deploying physical agents inside the cloud network.

WildFire cloud analysis allows the file to be delivered to the user while a copy is forwarded to the WildFire cloud for sandbox analysis. In this scenario this meets the requirement that the download is not delayed while still analyzing the file for zero-day malware. If the analysis later determines the file is malicious, WildFire delivers a signature that the security processing node can use to block subsequent downloads and to generate alerts and WildFire logs for the original session.

Prisma Access Private Applications allow secure, clientless access to private web applications. They support SAML authentication, enabling contractors to authenticate via an identity provider without installing a GlobalProtect agent. The application is published through Prisma Access, and access is controlled by policies. This meets the requirement for agentless access on personal devices.

For mobile users to access on-premises applications via Service Connection, a Security Policy rule must allow traffic from the mobile user zone to the Service Connection zone. If this rule is missing or incorrect, traffic will be blocked. This is a common oversight and aligns with the symptoms.

Prisma Access advertises data centre subnets to the remote network through BGP; the Service Connection needs peer settings and export rules configured in Panorama. Without these, the tunnel shows Connected but no routes propagate, causing the reported routing failure.

Traffic logs in Prisma Access record all sessions and include details such as the security policy rule that matched, the action taken (allow/deny), and the reason for denial. Examining traffic logs will show if a security policy is blocking the connection to the private application, making it the correct log type for this troubleshooting.

DNS Security profiles are created under Objects -> Security Profiles and enforced via Security policy rules.

App-ID policies naming specific internal applications enforce least-privileged access by identifying the actual application rather than the underlying subnet, preventing lateral movement to unrelated services sharing that network range. This satisfies the stem's requirement for mandatory ZTNA 2.0 configuration controlling private application access.

WildFire submits downloaded executables and documents to a cloud-based behavioural sandbox, detonating them to observe malicious actions and identify previously unknown zero-day threats. This inline inspection within Prisma Access SWG satisfies the requirement to catch unknown malware.

Prisma Access natively supports BGP over its IPsec tunnels, allowing dynamic route exchange with the corporate data centre without extra overlay protocols. This satisfies the stem's requirement for a natively supported dynamic routing protocol across the Service Connection.

In Prisma Access, threat prevention profiles are attached to security policy rules. The engineer should edit the security rule that permits the traffic and, under Actions, select the appropriate threat prevention profile in the Profile Setting. This applies the profile to all traffic matching the rule, both inbound and outbound, as long as the rule covers both directions. This is the correct method to enforce threat prevention.

This is correct because Prisma Access supports multiple tunnels from a remote network to different service connections. By running BGP over these tunnels, the remote network can advertise its routes and learn Prisma Access routes. If the primary tunnel fails, BGP withdraws the routes, and traffic fails over to the backup tunnel automatically. This provides redundancy and automatic failover.

GlobalProtect resolves the closest Prisma Access gateway through cloud DNS, then applies regional gateway priority so European users land on European nodes and North American users on North American nodes. This satisfies the stem's geographic routing requirement automatically, without manual client configuration.

Prisma Access terminates mobile-user tunnels at redundant gateways distributed across multiple geographic regions, so a failed location or component fails over to another. This cloud-scale redundancy delivers the resilient connectivity and high availability the stem requires for mobile users.

In Prisma Access, when you configure a remote network, you specify the IP addresses or subnets that are used by the branch. These IP addresses are then available as source addresses in security policies. The remote network configuration defines the source IPs for traffic originating from that branch, allowing policy enforcement based on those addresses.

When DNS proxy is enabled, administrators can configure split DNS by adding internal domains and specifying the internal DNS servers. This allows the proxy to forward queries for those domains to the internal servers, while resolving other queries externally. This is the correct step to enable internal domain resolution.

Terminating redundant IPsec tunnels on separate CPE devices or diverse ISP links removes single points of failure, so Remote Network traffic survives a device or circuit outage. This directly satisfies the stem's redundancy and performance optimisation goal for Prisma Access connectivity.

In Prisma Access, to enforce web filtering, a URL Filtering profile must be attached to the security policy rule that allows web traffic. Without a URL Filtering profile, the rule simply allows all web traffic without inspecting or blocking based on URL categories. The SWG license enables the service, but the actual blocking requires the profile. This is the most likely missing configuration that allows malicious websites to be accessed.

ZTNA depends on GlobalProtect establishing the tunnel and reporting HIP data, since application access policies are matched against HIP profiles. Confirming tunnel state and current HIP ensures the endpoint meets posture conditions before investigating policy or connector faults.

CASB inline enforcement requires visibility into the encrypted payload to match file-level attributes; without SSL decryption, the firewall sees only metadata and cannot identify the file upload, so the inline block action never triggers despite the correct application being matched.

MFA is enforced by the Identity Provider (IdP) that Prisma Access integrates with for SAML authentication. When users authenticate, the IdP challenges them for a second factor. Prisma Access relies on the IdP to perform MFA and then accepts the SAML assertion. Thus, the IdP is responsible for MFA enforcement.

A Data Filtering profile inspects traffic for sensitive data patterns and file types, blocking uploads of proprietary content to unsanctioned cloud storage. Applied to Security Policy rules, it satisfies the requirement to prevent data exfiltration via unauthorised applications.

Schedule Objects define reusable time windows, such as working hours excluding a lunch interval, and attach directly to Security Policy rules. This satisfies the stem's requirement for time-based enforcement, letting the same Gambling URL category be blocked during working hours yet permitted during lunch breaks without duplicating rules.