Courseiva

CCNA Prisma Access Troubleshooting Questions

75 of 98 questions · Page 1/2 · Prisma Access Troubleshooting · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

An enterprise deployment of Prisma Access uses explicit proxy. Users report that authentication prompts appear repeatedly when browsing internal web applications. What is the most likely cause of this authentication looping in an explicit proxy setup?

A.The BGP hold timer is set too low on the Service Connection.
B.Missing proxy bypass entries for authentication provider login pages or incorrect cookie persistence settings in the explicit proxy profile.
C.SSL Forward Proxy decryption is disabled on the untrust zone.
D.The GlobalProtect agent version is incompatible with explicit proxy.
AnswerB

Explicit proxy authentication loops occur when the proxy intercepts the identity provider's own login traffic, so credentials are never cached. Bypassing those login pages and correcting cookie persistence in the explicit proxy profile restores the authentication flow, satisfying the stem's repeated-prompt symptom.

Why this answer

In an explicit proxy deployment, authentication looping typically occurs when the proxy intercepts the identity provider's login pages or when cookie persistence is misconfigured, causing the proxy to challenge the user repeatedly instead of honoring the authentication cookie. Adding proxy bypass entries for authentication provider URLs and correcting cookie persistence settings in the explicit proxy profile resolves the loop.

Exam trap

SSE-Engineer often tests explicit proxy authentication mechanics, so the trap is attributing repeated login prompts to tunnel or routing issues rather than to proxy bypass and cookie persistence configuration.

How to eliminate wrong answers

Option A is wrong because BGP hold timers govern routing adjacency stability on the Service Connection, not user authentication behavior through an explicit proxy. Option C is wrong because SSL Forward Proxy decryption being disabled would prevent inspection of encrypted traffic, but it would not cause repeated authentication prompts — it would simply leave traffic uninspected. Option D is wrong because GlobalProtect agent version compatibility is irrelevant to explicit proxy authentication; explicit proxy clients are browsers or PAC-configured endpoints, not necessarily GlobalProtect agents.

Practice this question →
2
Multi-Selectmedium

A Prisma Access administrator is troubleshooting a remote network where users experience slow throughput over the IPsec tunnel. The administrator suspects that the issue is related to the IPsec configuration or the underlying network. Which two actions should the administrator take to identify the cause? (Choose two.)

Select 2 answers
A.Increase the tunnel's bandwidth allocation in the Prisma Access portal
B.Verify the IPsec tunnel's IKE and IPsec security associations
C.Check for packet fragmentation and MTU issues along the path
D.Enable jumbo frames on the tunnel interface
E.Restart the IPsec tunnel to clear any transient errors
AnswersB, C

Checking the IKE and IPsec security associations helps confirm that the tunnel is established and that there are no mismatched parameters causing renegotiation or packet loss. If the security associations are flapping or using weak encryption, throughput can suffer. This action provides insight into the tunnel's health and stability, which are critical for performance. It is a fundamental step when troubleshooting slow throughput over an IPsec tunnel.

Why this answer

Verifying the IPsec tunnel's IKE and IPsec security associations ensures that the tunnel is stable and using appropriate parameters, while checking for packet fragmentation and MTU issues addresses a common cause of throughput degradation. Both actions are diagnostic and directly related to identifying why throughput is slow. They help the administrator pinpoint whether the problem is due to security association renegotiation or packet fragmentation.

Exam trap

The trap here is assuming that increasing bandwidth or restarting the tunnel will solve performance issues, when the real causes are often configuration-related such as MTU mismatches or unstable security associations.

Practice this question →
3
MCQhard

An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?

A.Inspect the custom application definitions and ensure Custom App-IDs are mapped to the correct non-standard ports, and that security rules permit those ports.
B.Configure a static NAT rule for the non-standard ports on the service connection.
C.Disable GlobalProtect pre-logon mode.
D.Enable SSL Forward Proxy on the destination zones.
AnswerA

Custom App-IDs bind non-standard TCP ports to application signatures, so App-ID inspection recognises and permits that traffic. Without this mapping, the firewall cannot identify the application on those ports, and security rules referencing the custom App-ID will not match, causing connection failures through the Remote Network node.

Why this answer

Prisma Access App-ID inspection relies on application signatures that map to specific TCP/UDP ports. When an application runs on a non-standard port, the default App-ID signature won't match, so the session may be dropped or misclassified. Creating a Custom App-ID that explicitly lists the non-standard port, then referencing it in a security rule that permits that port, allows the traffic to be identified and inspected correctly through the explicit/transparent proxy.

Exam trap

SSE-Engineer often tests the confusion between NAT, decryption, and App-ID, tricking candidates into picking a feature that sounds like it 'opens ports' when the real answer is defining a Custom App-ID and permitting it in policy.

How to eliminate wrong answers

Option B is wrong because static NAT on the service connection translates addresses, not ports for App-ID classification, and does nothing to help the proxy recognize the custom application. Option C is wrong because GlobalProtect pre-logon mode affects when the tunnel is established relative to user login, and has no relationship to non-standard TCP port handling. Option D is wrong because SSL Forward Proxy decrypts outbound TLS sessions; it does not define which ports App-ID inspects and would not resolve a custom-port application failure.

Practice this question →
4
MCQeasy

A remote user reports that their GlobalProtect connection connects successfully to Prisma Access, but they cannot resolve internal fully qualified domain names (FQDNs). Where should the administrator check to ensure DNS server IP addresses are correctly pushed to the GlobalProtect client?

A.Panorama > Prisma Access > Setup > Portal > Agent > Client Settings.
B.Prisma Access > Cloud Services > Status.
C.Panorama > Managed Devices > Remote Networks.
D.Panorama > Policy > Security.
AnswerA

DNS server addresses reach GlobalProtect clients through the agent configuration pushed from the portal. Panorama > Prisma Access > Setup > Portal > Agent > Client Settings holds the DNS split-tunnel and server settings, satisfying the requirement that internal FQDNs resolve.

Why this answer

DNS server IP addresses pushed to GlobalProtect clients are configured in the Client Settings section of the GlobalProtect Portal agent configuration, which is managed under Panorama > Prisma Access > Setup > Portal > Agent > Client Settings. This is where administrators define the DNS servers, split-tunnel DNS domains, and other network settings that the portal pushes to the GlobalProtect app. If internal FQDNs cannot be resolved, the DNS server list in this configuration is the first place to verify.

Exam trap

SSE-Engineer often tests the confusion between portal agent client settings (which push DNS, split tunnel, etc.) and other Panorama sections like Cloud Services Status or Remote Networks, causing candidates to look in the wrong configuration area.

How to eliminate wrong answers

Option B is wrong because Prisma Access > Cloud Services > Status only shows the health and provisioning status of Prisma Access components, not client DNS configuration. Option C is wrong because Panorama > Managed Devices > Remote Networks configures remote network (branch) connectivity, not GlobalProtect mobile user client settings. Option D is wrong because Panorama > Policy > Security contains security rules that control traffic flow, not DNS server assignment to GlobalProtect clients.

Practice this question →
5
MCQeasy

A help desk technician reports that a Prisma Access mobile user cannot reach any resources, and the GlobalProtect client displays 'Portal unreachable' before the user even authenticates. The administrator confirms the user's internet connectivity is fine and other users at the same site are connected successfully. Which troubleshooting step should the administrator perform first?

A.Check the user's HIP profile match against the HIP-enabled security policy.
B.Examine the user's decryption policy to see whether the portal certificate is being intercepted.
C.Restart the Service Connection to refresh the data center IPsec tunnel.
D.Verify the portal FQDN resolves correctly from the client and that the required portal ports are reachable.
AnswerD

'Portal unreachable' means the client cannot establish the initial HTTPS connection to the portal, which happens before authentication or tunnel setup. Because other users at the same site connect fine, the issue is likely client-specific DNS resolution or a local firewall blocking the portal port. Confirming name resolution and port reachability directly tests the first connection stage that is failing.

Why this answer

The error appears before authentication, so the failing stage is the client's initial HTTPS connection to the portal. Since peers at the same site succeed, the fault is local to this client, most likely DNS resolution of the portal FQDN or a blocked port. Verifying resolution and port reachability targets that first connection stage.

Exam trap

The trap here is jumping to post-authentication controls such as HIP or decryption policy when the failure happens before the user can even authenticate to the portal.

Practice this question →
6
Multi-Selecthard

An administrator is troubleshooting a Prisma Access deployment experiencing intermittent packet drops and high latency across remote branches. Which THREE diagnostic steps or tools should be used? (Choose three)

Select 3 answers
A.Modify the administrative administrator accounts in Panorama.
B.Check IPsec tunnel monitoring statistics and DPD settings for packet loss and tunnel flapping.
C.Check the GlobalProtect portal certificate expiration date.
D.Verify TCP MSS clamping and MTU configurations across the IPsec tunnels to prevent packet fragmentation.
E.Review QoS bandwidth allocation and utilization to ensure critical traffic is not being dropped due to congestion.
AnswersB, D, E

IPsec tunnel statistics expose packet loss, rekey failures and latency across the tunnel, while Dead Peer Detection settings reveal flapping caused by missed keepalives or mismatched timers. Since the stem describes intermittent drops and high latency across remote branches, this directly targets the site-to-site VPN path rather than unrelated policy or endpoint causes.

Why this answer

Option B is correct because intermittent drops and high latency across remote branches in a Prisma Access deployment are frequently caused by IPsec tunnel instability, so examining tunnel monitoring statistics and Dead Peer Detection (DPD) settings helps identify packet loss, rekey failures, and tunnel flapping. Option D is correct because MTU and TCP MSS clamping mismatches on IPsec tunnels cause fragmentation or dropped oversized packets, which directly produces intermittent packet loss and latency symptoms that must be verified and corrected. Option E is correct because QoS bandwidth allocation and utilization review reveals whether congestion is dropping or delaying critical traffic, a common cause of high latency and drops on branch links.

Option A does not belong because modifying Panorama administrator accounts is an administrative access change unrelated to packet forwarding, latency, or tunnel performance. Option C does not belong because GlobalProtect portal certificate expiration would cause authentication or connection failures for remote users, not the intermittent packet drops and latency described in the scenario.

Exam trap

SSE-Engineer often tests the specific diagnostic steps for network performance issues, and candidates may choose irrelevant options like certificate expiration or admin account changes.

Practice this question →
7
Multi-Selectmedium

Which TWO actions should an administrator take when troubleshooting high CPU utilization on Prisma Access cloud infrastructure nodes? (Choose two)

Select 2 answers
A.Check ACC and Traffic/Threat logs to identify traffic spikes, unusual session volumes, or potential security attacks.
B.Modify the GlobalProtect client portal authentication profile.
C.Generate and analyze a Tech Support File (TSF) specifically for Prisma Access via Panorama to review system resource allocation and daemon status.
D.Update the Antivirus dynamic signature version.
E.Restart the customer CPE device at the branch location.
AnswersA, C

ACC and Traffic/Threat logs expose session volumes, application mix and attack signatures traversing the nodes. Correlating a CPU spike with a traffic surge or exploit attempt identifies whether load is legitimate volume or malicious, directly addressing the need to find the workload driving utilisation.

Why this answer

Option A is correct because Prisma Access high CPU on cloud infrastructure nodes is frequently caused by traffic surges, session exhaustion, or attack traffic, and the ACC plus Traffic/Threat logs in Panorama provide the visibility needed to correlate CPU spikes with specific applications, users, session counts, or threat signatures. Option C is correct because generating a Tech Support File for Prisma Access from Panorama captures the cloud node's system resource data, running processes, and daemon status, which is the standard evidence-gathering step for diagnosing which process (for example, the dataplane or management daemon) is consuming CPU. Option B is not relevant because changing the GlobalProtect portal authentication profile affects user login behavior, not cloud node CPU consumption.

Option D is not relevant because updating the Antivirus dynamic signature version is a content update action and does not address the root cause of high CPU on infrastructure nodes. Option E is not relevant because restarting a branch customer CPE device affects the remote site's connectivity and would not resolve CPU load on Prisma Access cloud infrastructure nodes.

Exam trap

SSE-Engineer often tests the misconception that client-side or authentication changes (like GlobalProtect portal settings) can resolve cloud infrastructure performance issues, when in fact troubleshooting must focus on cloud-native tools like ACC logs and Prisma Access TSF.

Practice this question →
8
MCQeasy

An administrator is investigating a security alert in Prisma Access triggered by an Anti-Spyware profile. Which log contains the detailed packet capture (pcap) or attack details for this specific event?

A.Monitor > Logs > HIP Match.
B.Monitor > Logs > Threat.
C.Panorama > Cloud Services > Audit Log.
D.Monitor > Logs > URL Filtering.
AnswerB

Threat logs record Anti-Spyware and vulnerability events with the offending packet capture, severity, threat name and session details, giving the investigator the attack specifics that traffic, URL or WildFire logs do not retain for this signature-based detection.

Why this answer

In Prisma Access and PAN-OS, threat logs (Monitor > Logs > Threat) record all events generated by security profiles including Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire. When an Anti-Spyware profile triggers an alert, the detailed attack information — including the threat name, severity, source/destination, and often a packet capture (pcap) if configured — is stored in the Threat log. This is the correct location to investigate the specific event.

Exam trap

SSE-Engineer often tests the confusion between Threat logs (security profile detections) and WildFire Submissions logs (file analysis verdicts) — candidates may pick the wrong log when the question mentions a specific profile like Anti-Spyware.

How to eliminate wrong answers

Option A is wrong because HIP Match logs record Host Information Profile data from GlobalProtect endpoints (e.g., OS version, patch level, antivirus status) used for HIP-based policy enforcement, not threat or spyware events. Option C is wrong because the Panorama Cloud Services Audit Log tracks administrative and configuration changes made to Prisma Access cloud services, not security threat detections. Option D is wrong because URL Filtering logs record web browsing activity and URL category matches, not Anti-Spyware or packet-level attack details.

Practice this question →
9
MCQmedium

An administrator needs to verify whether a Prisma Access Remote Network is successfully exchanging routes with the customer CPE router over BGP. Where can the real-time BGP peer state be checked?

A.Review the System log for BGP daemon errors.
B.Examine the Traffic log for BGP port 179 sessions.
C.Check the GlobalProtect gateway log.
D.Run operational CLI commands such as 'show routing protocol bgp peer' or check the routing status in the Prisma Access monitoring dashboard.
AnswerD

BGP peer state is exposed through operational CLI commands and the Prisma Access routing status view, which report the live session between the remote network and customer CPE. This directly satisfies the requirement to verify real-time route exchange rather than inferring it from configuration.

Why this answer

Prisma Access Remote Networks use BGP to exchange routes between the customer CPE and the Prisma Access service connection. The authoritative way to verify real-time BGP peer state is through operational commands like 'show routing protocol bgp peer' on the relevant node or via the Prisma Access monitoring dashboard's routing status view. These tools display the current BGP session state (e.g., Established, Idle, Active), prefixes received/advertised, and uptime.

Logs and traffic logs do not provide live peer state.

Exam trap

SSE-Engineer often tests the misconception that BGP peer state can be inferred from traffic or system logs, when in fact it requires dedicated operational commands or the monitoring dashboard.

How to eliminate wrong answers

Option A is wrong because System logs capture daemon errors and events, not real-time BGP peer state; they may show a BGP process restart but not the current session status. Option B is wrong because Traffic logs record allowed/denied sessions and may show port 179 traffic, but they do not indicate whether the BGP session is Established or what routes are exchanged. Option C is wrong because GlobalProtect gateway logs pertain to user VPN connections, not site-to-site BGP peering with a CPE router.

Practice this question →
10
MCQmedium

An administrator is troubleshooting a Prisma Access deployment where mobile users report slow performance when accessing SaaS applications. The administrator suspects that traffic is being backhauled through a service connection instead of going directly to the internet. Which Prisma Access feature should the administrator verify to ensure that traffic is taking the optimal path?

A.HIP-based policy
B.SSL decryption
C.Local breakout
D.Quality of Service (QoS)
AnswerC

Local breakout allows mobile user traffic destined for the internet to egress directly from the Prisma Access location nearest to the user, rather than being backhauled to a service connection. If local breakout is not enabled or misconfigured, traffic may take a suboptimal path, causing latency. Verifying this feature ensures that SaaS traffic uses the best path. This directly addresses the performance issue.

Why this answer

Local breakout is designed to optimize mobile user internet access by egressing traffic at the nearest Prisma Access location. If it is not enabled, traffic may be backhauled to a service connection, adding latency. Verifying local breakout settings ensures that SaaS traffic takes the optimal path.

Other features like HIP, decryption, and QoS do not control traffic routing and are not relevant to the backhauling concern.

Exam trap

The trap here is confusing performance optimization features like QoS with routing features like local breakout, leading to checking the wrong configuration.

Practice this question →
11
MCQeasy

An administrator wants to check the status of active IPsec tunnels for a Prisma Access Remote Network location. Which Panorama menu path provides the most direct overview of IPsec tunnel health?

A.Policies > Security.
B.Device > High Availability.
C.Monitor > Traffic.
D.Panorama > Cloud Services > Status > Remote Networks.
AnswerD

Panorama > Cloud Services > Status > Remote Networks lists each remote network's IPsec tunnel state, showing whether tunnels are up or down alongside peer and gateway details. This directly satisfies the requirement to check active IPsec tunnel status for a Remote Network location without navigating device-level CLI or per-firewall dashboards.

Why this answer

Panorama > Cloud Services > Status > Remote Networks provides a consolidated view of each Remote Network node's health, including IPsec tunnel status, BGP peering state, and bandwidth utilization. This is the most direct path to check whether the IPsec tunnels for a specific remote network location are up or down.

Exam trap

SSE-Engineer often tests the difference between traffic monitoring (Monitor > Traffic) and infrastructure health monitoring (Cloud Services > Status), catching candidates who pick the traffic log path for tunnel status.

How to eliminate wrong answers

Option A is wrong because Policies > Security is where security rules are configured, not where tunnel status is monitored. Option B is wrong because Device > High Availability relates to HA peer configuration and state for firewalls, not Prisma Access IPsec tunnel health. Option C is wrong because Monitor > Traffic shows session and traffic logs, which can confirm traffic flow but does not directly display IPsec tunnel state or BGP status for remote networks.

Practice this question →
12
MCQmedium

An administrator is troubleshooting a Prisma Access deployment where mobile users are unable to access certain SaaS applications. The users are connected via GlobalProtect, and the administrator has confirmed that the GlobalProtect tunnel is up. The administrator suspects that the issue is related to SSL decryption. Which action should the administrator take to verify that SSL decryption is functioning correctly?

A.Ensure that the decryption policy includes the SaaS applications in the decryption profile.
B.Verify that the forward trust certificate is installed on the mobile users' devices.
C.Confirm that the SaaS applications are not excluded from decryption in the decryption policy.
D.Check the SSL Decryption logs in the Prisma Access dashboard for errors related to the SaaS applications.
AnswerD

The SSL Decryption logs provide detailed information about decryption successes and failures. If decryption is failing for the SaaS applications, the logs will show errors such as certificate issues or unsupported cipher suites. This is the most direct way to verify whether decryption is the root cause of the access issue, as it captures the actual decryption events.

Why this answer

SSL Decryption logs are the primary source for troubleshooting decryption issues. They record why decryption succeeded or failed, including certificate errors, unsupported protocols, or policy mismatches. When users cannot access SaaS applications and the tunnel is up, checking these logs can quickly reveal if decryption is failing and why.

This allows the administrator to pinpoint whether the issue is due to decryption configuration, certificates, or other factors.

Exam trap

The trap here is assuming that missing decryption exclusions or certificates are the issue without first checking logs to see if decryption is actually failing.

Practice this question →
13
MCQhard

An SSE engineer is investigating why a Prisma Access mobile user's traffic to a SaaS application is being inspected by a decryption policy that should be bypassed. The decryption policy has a source user group that should exclude this user, and the user is a member of a different group. The engineer confirms the user's group membership in the identity provider is correct. Which factor is most likely causing the decryption policy to match unexpectedly?

A.The decryption policy is evaluated before user identification, so group-based conditions are ignored during the first session.
B.The decryption profile assigned to the policy is misconfigured, causing the policy to apply to all users regardless of group conditions.
C.SSL decryption bypass rules take precedence only when the destination is in a predefined category, not when a source user group is used.
D.The user's group membership has not yet been synchronized to Prisma Access, so the policy evaluates an outdated or empty group mapping.
AnswerD

Prisma Access relies on the identity provider group mapping being synchronized to the cloud service. If the user's current group is not yet reflected, the policy may match on stale membership data and apply decryption. This is a frequent cause of unexpected policy matches and should be verified in the identity mapping before changing policy logic.

Why this answer

Unexpected decryption matches on group-based policies usually stem from identity information being out of date in Prisma Access. If the user's group mapping has not synchronized, the policy evaluates against stale or missing data and can match a rule that should have been excluded, applying decryption where a bypass was intended.

Exam trap

The trap here is blaming the decryption profile or policy order when the actual root cause is stale user-to-group mapping in the cloud service.

Practice this question →
14
Multi-Selecthard

An enterprise network team is troubleshooting a Prisma Access Remote Network deployment where DNS queries from branch offices are failing to resolve internal resources. Which THREE components should be inspected? (Choose three)

Select 3 answers
A.Check the Service Connection routing configuration to ensure DNS traffic destined for internal DNS servers is correctly routed across the Service Connection tunnel.
B.Examine Security Policy rules to ensure that DNS traffic (Port 53 TCP/UDP) is permitted between the branch zone and the Service Connection / internal zones.
C.Verify the GlobalProtect client portal certificate.
D.Check the WildFire threat prevention subscription license key.
E.Verify that the primary and secondary DNS server IP addresses are correctly configured in the Remote Network settings in Panorama.
AnswersA, B, E

Remote Network DNS queries traverse the Service Connection tunnel to reach internal DNS servers, so incorrect routing there black-holes them. Verifying this routing satisfies the stem's requirement to inspect components causing branch DNS resolution failure.

Why this answer

Option A is correct because in a Prisma Access Remote Network deployment, DNS queries to internal servers must traverse the Service Connection tunnel, so the Service Connection routing configuration must include the internal DNS server subnets; otherwise queries are dropped or sent elsewhere. Option B is correct because Security Policy rules must explicitly permit DNS (UDP/TCP port 53) from the branch/Remote Network zone to the Service Connection or internal zones, and a missing or misordered rule will silently block resolution. Option E is correct because the Remote Network configuration in Panorama defines the DNS server IP addresses handed to branch clients; if the primary and secondary DNS server IPs are wrong or missing, clients cannot resolve internal resources.

Option C is not relevant because the GlobalProtect client portal certificate affects user/endpoint connectivity and authentication, not branch Remote Network DNS forwarding. Option D is not relevant because WildFire is a threat prevention subscription for file analysis and does not influence DNS resolution for internal resources.

Exam trap

SSE-Engineer often tests the confusion between mobile user components (GlobalProtect certificates) and Remote Network components (Service Connection routing, DNS settings), tricking candidates into selecting mobile-user-related options for a branch DNS issue.

Practice this question →
15
Multi-Selectmedium

Which TWO tools or logs in Panorama should an administrator use when troubleshooting a security policy rule that is unexpectedly dropping legitimate user traffic in Prisma Access? (Choose two)

Select 2 answers
A.Monitor > Logs > Traffic to identify sessions marked with a 'deny' action and note the matching rule name.
B.Device > High Availability status.
C.The CLI command 'test security-policy-match' to simulate traffic and verify rule evaluation.
D.Monitor > Dynamic Updates > Status.
E.Panorama > Cloud Services > Audit Log.
AnswersA, C

The Traffic log records each session's action and the name of the rule that matched it, so filtering for 'deny' entries reveals exactly which policy rule is dropping the legitimate traffic. This directly satisfies the stem's requirement to identify the offending rule in Prisma Access.

Why this answer

Option A is correct because Monitor > Logs > Traffic in Panorama shows the traffic log entries for Prisma Access sessions, including the Action field (allow/deny/drop) and the Rule Name that matched, which directly identifies which security policy rule is unexpectedly denying legitimate user traffic. Option C is correct because the CLI command 'test security-policy-match' (run on the firewall or Prisma Access node) simulates a flow with specified source, destination, user, application, and service, then reports which security rule would match and the resulting action, letting the administrator verify rule evaluation order and confirm why the traffic is being dropped. Option B is incorrect because Device > High Availability status only reports HA peer state and synchronization, not security policy rule matching.

Option D is incorrect because Monitor > Dynamic Updates > Status shows content, antivirus, and app/threat signature update versions, not policy rule decisions. Option E is incorrect because Panorama > Cloud Services > Audit Log records administrative and configuration change activity, not live traffic policy enforcement decisions.

Exam trap

The trap is confusing monitoring tools: candidates may pick Audit Log or Dynamic Updates, but only Traffic log and policy-match directly address policy drops.

Practice this question →
16
MCQeasy

An administrator wants to verify that threat prevention signatures are actively blocking simulated malicious traffic in a Prisma Access environment. Which testing tool or procedure is standard for verifying threat signatures safely?

A.Perform a Denial of Service attack against the Prisma Access public IP.
B.Disable SSL decryption across all security rules.
C.Restart the Panorama management server.
D.Use standardized test payloads or URLs (such as the EICAR string for antivirus or PANW test URLs) and check the Threat log.
AnswerD

EICAR strings and PANW test URLs are harmless, standardised payloads that trigger antivirus and URL-filtering signatures. Sending them and confirming blocks in the Threat log verifies signatures are active without introducing real malware into the environment.

Why this answer

Using standardized test payloads like the EICAR string for antivirus or PANW-provided test URLs is the safe, standard method to verify that threat prevention signatures are actively blocking malicious traffic. These tests generate benign traffic that matches known signatures, and the results appear in the Threat log, confirming enforcement without causing harm.

Exam trap

SSE-Engineer often tests the difference between safe verification methods and disruptive actions, tempting candidates to choose aggressive testing like DoS attacks.

How to eliminate wrong answers

Option A is wrong because performing a Denial of Service attack is unethical, illegal, and disruptive; it does not safely verify signatures. Option B is wrong because disabling SSL decryption would reduce security visibility and is not a testing procedure. Option C is wrong because restarting Panorama has no relevance to testing threat signatures and could cause management disruption.

Practice this question →
17
MCQeasy

A Prisma Access administrator needs to verify that the GlobalProtect portal is presenting the correct certificate to mobile users during authentication. Which tool should the administrator use to inspect the certificate presented by the portal?

A.Check the GlobalProtect app logs on a client to see the certificate details.
B.Use the 'openssl s_client' command from a client machine to connect to the portal and view the certificate.
C.Use a browser to navigate to the portal and click on the padlock icon to view the certificate.
D.Run 'show global-protect-portal certificate' from the Prisma Access CLI.
AnswerB

The 'openssl s_client' command initiates a TLS connection to the specified host and port, and displays the certificate chain presented by the server. This allows the administrator to verify the certificate details, such as subject, issuer, and expiration. It is a standard and effective method to inspect the certificate the portal is using for HTTPS connections.

Why this answer

The 'openssl s_client' command connects to the portal's HTTPS port and displays the certificate chain, allowing the administrator to verify the exact certificate presented. This is a direct and reliable method to inspect the certificate, ensuring it matches the expected configuration. Other methods may show cached or different certificates, leading to confusion.

Exam trap

The trap here is assuming that the browser padlock or GlobalProtect logs show the same certificate used for GlobalProtect portal authentication, when the portal may present different certificates for different services.

Practice this question →
18
MCQhard

An administrator is troubleshooting a Prisma Access remote network where IPsec tunnel status shows up, but traffic from the branch is intermittently dropped when it exceeds a certain throughput. The branch has a single ISP link with 500 Mbps capacity and the tunnel is configured with default settings. Which cause should the administrator investigate first?

A.The IPsec tunnel is hitting bandwidth or packet-per-second limits tied to the selected compute location or license, causing drops above the threshold.
B.The tunnel MTU is too low, causing fragmentation that only manifests when throughput increases.
C.The IPsec proposal is using a cipher that cannot sustain more than a fixed number of packets per second on the branch device.
D.The branch ISP is applying traffic shaping that only affects IPsec-encapsulated packets above 500 Mbps.
AnswerA

Prisma Access remote network tunnels are subject to capacity limits determined by the location's compute resources and the licensed bandwidth. If traffic exceeds the supported throughput, packets are dropped even though the tunnel remains up. Investigating the location capacity and license tier directly addresses the intermittent drops at higher rates.

Why this answer

When an IPsec tunnel stays up but traffic drops above a certain throughput, the most likely cause is a capacity limit on the Prisma Access side, such as the compute location's bandwidth or the licensed throughput for remote networks. Verifying the location capacity and license tier is the correct first step before blaming the ISP or encryption settings.

Exam trap

The trap here is assuming that an up tunnel means unlimited capacity, when Prisma Access remote networks enforce bandwidth and packet-rate limits tied to the location and license.

Practice this question →
19
MCQhard

An administrator notices that a subset of mobile users connecting via GlobalProtect in Prisma Access cannot resolve internal corporate hostnames, while external websites load normally. The split-tunnel configuration includes the corporate domain. Where should the administrator check first in Panorama to troubleshoot this DNS resolution failure?

A.Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config > DNS and-or WINS.
B.Panorama > Prisma Access > Monitoring > ACC.
C.Panorama > Cloud Services > Status > Traffic Log.
D.Panorama > Firewall > Network Profiles > Interface.
AnswerA

The split-tunnel DNS suffix list governs which queries GlobalProtect forwards to internal resolvers, so a missing or malformed corporate domain entry here directly explains internal-only resolution failures while external lookups succeed. Verify the DNS suffix and resolver settings under Client Config, since that configuration is pushed to mobile users and overrides local device DNS behaviour.

Why this answer

DNS and WINS settings for GlobalProtect mobile users are configured under Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config. If internal hostnames fail to resolve while external sites work, the DNS server list or suffix pushed to clients is likely missing or incorrect, so this is the first place to verify. The split-tunnel domain inclusion only routes traffic; it does not supply DNS servers.

Exam trap

SSE-Engineer often tests the difference between split-tunnel routing and DNS server delivery, so the trap is assuming that adding the corporate domain to split-tunnel automatically fixes internal name resolution.

How to eliminate wrong answers

Option B is wrong because the ACC (Application Command Center) is a monitoring and visibility dashboard for traffic and threats, not a configuration location for client DNS settings. Option C is wrong because the Cloud Services Status > Traffic Log shows logged traffic events for troubleshooting flows, not the DNS server configuration pushed to GlobalProtect clients. Option D is wrong because firewall interface network profiles define Layer 3 interface settings on firewalls, not the DNS/WINS servers delivered to mobile users via the GlobalProtect client config.

Practice this question →
20
MCQmedium

A Prisma Access administrator notices that a mobile user's traffic to a sanctioned SaaS application is being routed through a Service Connection in a different region than expected, causing high latency. The administrator wants to verify which Service Connection the user's session is currently using for that application. Which action should the administrator take?

A.Use the Prisma Access CLI command 'show service-connection status' to display active connections.
B.Review the GlobalProtect app logs on the user's endpoint for the selected gateway and service connection.
C.Check the Traffic logs in the Prisma Access Insights or the Strata Logging Service for the session details.
D.Run a traceroute from the user's endpoint to the SaaS application to see the path.
AnswerC

Traffic logs in Prisma Access Insights or Strata Logging Service contain fields such as 'Service Connection' or 'Source Service Connection' that identify the egress point for the session. Filtering by user and application will reveal the specific Service Connection in use, allowing the administrator to confirm the region and troubleshoot latency. This is the correct method to verify the actual path taken.

Why this answer

Traffic logs in Prisma Access Insights or Strata Logging Service include detailed session information, including the Service Connection used for egress. By filtering logs for the specific user and application, the administrator can see exactly which Service Connection is handling the traffic. This directly answers the question and enables troubleshooting latency issues related to regional egress selection.

Exam trap

The trap here is assuming that endpoint-based tools like traceroute or GlobalProtect logs can reveal the internal Prisma Access Service Connection selection, when only centralized traffic logs provide that detail.

Practice this question →
21
MCQmedium

An administrator needs to verify whether Host Information Profile (HIP) checks are failing for a specific mobile user attempting to connect to Prisma Access. Which log should the administrator review in Panorama?

A.Monitor > Logs > Threat.
B.Monitor > Logs > System.
C.Panorama > Cloud Services > Audit Log.
D.Monitor > Logs > HIP Match.
AnswerD

The HIP Match log records each HIP check result, including which host profiles passed or failed for a connecting user. Reviewing Monitor > Logs > HIP Match therefore shows exactly why the mobile user's checks are failing.

Why this answer

HIP Match logs in Panorama (Monitor > Logs > HIP Match) record the results of Host Information Profile checks, including which HIP profiles matched or failed for a connecting endpoint. This is the correct log to determine whether HIP checks are failing for a specific mobile user. Threat, System, and Audit logs do not contain HIP match results.

Exam trap

SSE-Engineer often tests the difference between HIP Match logs and System logs; candidates who see 'HIP' and think it is a system-level event choose System instead of the dedicated HIP Match log.

How to eliminate wrong answers

Option A is wrong because Monitor > Logs > Threat records security threat detections, not HIP profile matching results. Option B is wrong because Monitor > Logs > System records system-level events such as tunnel negotiations and service restarts, not HIP check outcomes. Option C is wrong because Panorama > Cloud Services > Audit Log tracks administrative configuration changes in the cloud service, not endpoint HIP evaluation results.

Practice this question →
22
MCQeasy

An administrator wants to view historical bandwidth utilization trends for a specific Remote Network location over the past 30 days. Which Panorama monitoring workspace provides this historical reporting?

A.Device > Setup > Management.
B.Panorama > Cloud Services > Audit Log.
C.Monitor > Reports.
D.Policies > QoS.
AnswerC

Monitor > Reports in Panorama retains aggregated historical data, including bandwidth and traffic trends, over configurable periods such as the last 30 days. This satisfies the requirement for historical reporting on a specific Remote Network location.

Why this answer

Panorama's Monitor > Reports workspace provides historical reporting, including bandwidth utilization trends over time for managed firewalls and Remote Network locations. This is where you access predefined and custom reports that aggregate data over days, weeks, or months, making it the correct place to view 30-day bandwidth trends.

Exam trap

SSE-Engineer often tests the confusion between configuration workspaces (Device, Policies) and monitoring workspaces (Monitor > Reports, Monitor > Logs), leading candidates to pick a configuration menu for a reporting task.

How to eliminate wrong answers

Option A is wrong because Device > Setup > Management is for configuring Panorama management settings (interfaces, certificates, logging), not for viewing historical reports. Option B is wrong because Panorama > Cloud Services > Audit Log shows administrative audit events for cloud services, not bandwidth utilization data. Option D is wrong because Policies > QoS is where QoS policies are configured, not where historical bandwidth reports are viewed.

Practice this question →
23
MCQmedium

An administrator is troubleshooting a Prisma Access mobile user who reports that corporate applications are unreachable, yet public websites load normally. In the Prisma Access status dashboard, the user's GlobalProtect connection shows Connected and the tunnel is assigned a 10.201.x.x address, but the Service Connection to the corporate data center shows a status of Down. Which action should the administrator take to resolve the user's issue?

A.Reassign the user to a different GlobalProtect gateway with lower latency to restore internal access.
B.Renew the GlobalProtect user certificate on the portal and have the user reconnect.
C.Add the internal application subnets to the GlobalProtect split-tunnel include list so they route through the tunnel.
D.Verify the Service Connection IPsec tunnel to the data center and bring the connection back up, since internal traffic depends on it.
AnswerD

Mobile users reach internal corporate applications through the Service Connection, not directly through the GlobalProtect tunnel alone. With that connection reporting Down, traffic destined for internal subnets has no path, while internet-bound traffic still egresses. Restoring the Service Connection IPsec tunnel re-establishes the route to the data center and resolves the internal-only reachability failure.

Why this answer

Internal corporate reachability for mobile users depends on the Service Connection between Prisma Access and the data center. A healthy GlobalProtect tunnel with working internet access but failed internal access points to that backend path. Confirming and restoring the Service Connection IPsec tunnel re-establishes routing to internal subnets, which is the correct remediation for this symptom.

Exam trap

The trap here is assuming any internal-access failure must be a GlobalProtect client or certificate problem, when the connected tunnel and working internet access already prove the client side is healthy.

Practice this question →
24
MCQmedium

A Prisma Access administrator is troubleshooting a Remote Network deployment where branch users cannot reach internal applications hosted in a data center connected via an IPsec tunnel. The administrator confirms that the Remote Network IPsec tunnel is up and that the branch firewall routes the internal subnets toward Prisma Access. Which action should the administrator take next to verify that Prisma Access is correctly routing traffic to the data center?

A.Verify that the branch firewall's IPsec tunnel interface is configured with the correct tunnel monitoring IP address.
B.Inspect the SSL Decryption profile applied to the Remote Network to ensure it is not blocking the internal application traffic.
C.Review the Prisma Access Service Connection status and verify the associated static routes for the data center subnets are present and active.
D.Check the GlobalProtect app logs on the branch users' endpoints to confirm they are receiving the correct internal DNS servers.
AnswerC

The Service Connection provides the path from Prisma Access to the data center. If the Service Connection is down or the static routes for the data center subnets are missing, Prisma Access cannot forward traffic to the internal applications. Verifying the Service Connection status and its routes directly confirms whether the return path exists.

Why this answer

The Service Connection is the component that links Prisma Access to the data center. If the Service Connection is down or lacks the necessary static routes, Remote Network users cannot reach internal applications even though their IPsec tunnel is up. Verifying the Service Connection status and its routes is the logical next step to isolate the routing failure.

Exam trap

The trap here is assuming that an up IPsec tunnel from the branch guarantees end-to-end connectivity, overlooking the Service Connection and its routing as a separate failure domain.

Practice this question →
25
MCQmedium

An administrator has deployed Prisma Access Remote Networks, but traffic from a branch office is failing to pass through the IPsec tunnel to Prisma Access. The IKE phase 1 negotiation is failing. Which Prisma Access operational command should the administrator run via the CLI to check the IPsec tunnel status and IKE SA parameters?

A.show globalprotect-gateway current-users
B.show vpn ike-sa gateway <gateway-name>
C.show system info
D.show running resource-monitor
AnswerB

The show vpn ike-sa gateway command displays IKE phase 1 security association state and parameters for the named gateway. Running it reveals why negotiation fails, directly satisfying the need to check IPsec tunnel status and IKE SA details during phase 1 troubleshooting.

Why this answer

On Palo Alto Networks firewalls and Prisma Access, the operational command 'show vpn ike-sa gateway <gateway-name>' displays IKE phase 1 security associations, including negotiation state, peer identity, and any failure reason. This is the correct CLI command to diagnose IKE phase 1 failures for a remote network IPsec tunnel.

Exam trap

SSE-Engineer often tests whether candidates confuse GlobalProtect remote-user commands with site-to-site IPsec commands — the trap is selecting 'show globalprotect-gateway current-users' when the question is about IKE phase 1 for a remote network tunnel.

How to eliminate wrong answers

Option A is wrong because 'show globalprotect-gateway current-users' lists connected GlobalProtect remote users, not site-to-site IPsec IKE SAs. Option C is wrong because 'show system info' returns platform, version, and uptime details and has no IKE or tunnel state information. Option D is wrong because 'show running resource-monitor' displays CPU, memory, and session resource utilisation, not IPsec or IKE SA parameters.

Practice this question →
26
MCQmedium

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

A.Use the CLI operational command 'show user ip-user-mapping all' or check User-ID status in the Prisma Access monitoring dashboard.
B.Check the GlobalProtect Gateway tunnel status.
C.Run 'show system software status'.
D.Verify the SSL Decryption certificate expiration date.
AnswerA

The CLI command 'show user ip-user-mapping all' lists IP-to-user mappings, confirming whether User-ID has populated entries for mobile users. Checking User-ID status in the Prisma Access monitoring dashboard corroborates this, revealing missing mappings that cause group-based security policies to fail matching traffic.

Why this answer

The CLI command 'show user ip-user-mapping all' displays the current IP-to-user mappings, and the Prisma Access monitoring dashboard shows User-ID status. This directly verifies whether User-ID mappings are populated for mobile users, which is required for user/group-based policy matching. If mappings are missing, policies won't match.

Exam trap

SSE-Engineer often tests whether candidates know the specific User-ID verification command versus generic tunnel or system status commands that don't reveal identity mappings.

How to eliminate wrong answers

Option B is wrong because GlobalProtect gateway tunnel status shows connectivity, not User-ID mapping contents. Option C is wrong because 'show system software status' reports software versions and uptime, unrelated to User-ID. Option D is wrong because SSL decryption certificate expiration affects decryption, not user identification.

Practice this question →
27
Multi-Selectmedium

Which TWO actions should an administrator take to troubleshoot an authentication failure when mobile users attempt to log into Prisma Access using SAML? (Choose two)

Select 2 answers
A.Modify the NAT policy rules.
B.Check the URL Filtering category for the IdP login domain.
C.Restart the physical firewall in the branch office.
D.Verify that the SAML Identity Provider (IdP) signing certificate imported into Panorama matches the active IdP certificate.
E.Check for clock skew between the SAML IdP and Prisma Access service nodes.
AnswersD, E

SAML assertions are signed by the IdP's private key and validated against the imported certificate. If Panorama holds a stale or mismatched signing certificate, signature validation fails and authentication is rejected, directly explaining the mobile user login failure.

Why this answer

Option D is correct because SAML assertions are validated against the IdP signing certificate imported into Panorama; if that certificate does not match the certificate the IdP is actively using to sign assertions, signature validation fails and authentication is rejected. Option E is correct because SAML assertions contain NotBefore and NotOnOrAfter conditions, so significant clock skew between the IdP and the Prisma Access service nodes causes valid assertions to be treated as expired or not yet valid, breaking login. Option A is wrong because NAT policy rules affect address translation and routing, not SAML assertion validation.

Option B is wrong because URL Filtering categories govern web access policy, not the SAML authentication exchange with the IdP. Option C is wrong because restarting a branch firewall does not address SAML trust, certificate, or time-synchronization problems on the Prisma Access side.

Exam trap

SSE-Engineer often tests the misconception that network-layer issues (NAT, URL filtering) cause SAML failures, when the root cause is typically certificate mismatch or clock skew between IdP and service provider.

Practice this question →
28
MCQhard

A Prisma Access deployment has multiple Remote Networks and Mobile Users. An administrator implements Quality of Service (QoS) to prioritize VoIP traffic over bulk file transfers. After applying the QoS profile, VoIP performance does not improve. What should the administrator verify first in the Prisma Access QoS configuration?

A.Verify the BGP AS number on the customer CPE.
B.Check the expiration date of the GlobalProtect gateway SSL certificate.
C.Verify that the QoS profile is applied to the correct security policy rules and that the guaranteed bandwidth settings align with the provisioned Prisma Access node bandwidth limits.
D.Ensure that GlobalProtect pre-logon mode is disabled.
AnswerC

QoS in Prisma Access is enforced through security policy rules, so a profile attached to the wrong rule never matches the VoIP traffic. Guaranteed bandwidth must also fit within the provisioned node's capacity; oversubscription causes the guarantee to be ignored, leaving bulk transfers competing unchecked.

Why this answer

QoS in Prisma Access only takes effect if the QoS profile is attached to the correct security policy rules and the guaranteed bandwidth settings are within the provisioned node bandwidth. If the profile isn't applied to the VoIP-matching rules or the bandwidth guarantees exceed node capacity, prioritization won't occur. Verifying this alignment is the first logical troubleshooting step.

Exam trap

SSE-Engineer often tests whether candidates chase unrelated issues (BGP, certificates, pre-logon) instead of verifying that the QoS profile is actually bound to the matching security policy and within node bandwidth limits.

How to eliminate wrong answers

Option A is wrong because the BGP AS number on the CPE affects routing, not QoS classification or prioritization. Option B is wrong because an expired SSL certificate would break the GlobalProtect tunnel entirely, not selectively degrade VoIP QoS. Option D is wrong because pre-logon mode affects authentication timing, not QoS enforcement.

Practice this question →
29
MCQhard

When troubleshooting a Prisma Access deployment using SAML authentication, an administrator notices that users are successfully authenticated by the IdP, but the GlobalProtect client displays an error stating 'Invalid SAML Response: Signature Validation Failed'. What is the most likely root cause?

A.The decryption policy is blocking HTTPS traffic to the IdP.
B.The IdP signing certificate imported into the Prisma Access authentication profile does not match the active certificate currently used by the IdP.
C.The User-ID agent service on Panorama has crashed.
D.The GlobalProtect client version is outdated and does not support SAML.
AnswerB

Signature validation compares the SAML assertion's signature against the certificate stored in the authentication profile. If the IdP has rotated to a new signing certificate while Prisma Access still holds the old one, validation fails even though authentication at the IdP succeeded.

Why this answer

The error 'Invalid SAML Response: Signature Validation Failed' means the GlobalProtect/Prisma Access SAML authentication profile could not verify the digital signature on the SAML assertion returned by the IdP. This almost always occurs when the signing certificate configured in the authentication profile does not match the certificate the IdP is currently using to sign assertions—typically because the IdP rotated its certificate and the old one is still imported.

Exam trap

SSE-Engineer often tests the specific wording of SAML errors, catching candidates who blame network/decryption issues when the message explicitly says 'Signature Validation Failed'—pointing to certificate mismatch.

How to eliminate wrong answers

Option A is wrong because a decryption policy blocking HTTPS to the IdP would prevent the SAML exchange entirely, producing a connection or timeout error, not a signature validation failure. Option C is wrong because the User-ID agent maps IP addresses to usernames for policy enforcement; it is not involved in SAML assertion validation. Option D is wrong because an outdated GlobalProtect client would fail earlier with protocol or feature-unsupported errors, not a specific SAML signature validation message.

Practice this question →
30
MCQmedium

A Prisma Access administrator is troubleshooting a mobile user who reports that after connecting via GlobalProtect, they cannot access internal web servers by hostname, but can access them by IP address. Other mobile users in the same region do not have this issue. Which component should the administrator verify first?

A.The SSL decryption policy applied to the user's traffic to ensure it is not blocking DNS queries.
B.The security policy rules that allow or deny traffic from the mobile user to the internal web servers.
C.The GlobalProtect app logs on the user's endpoint to check for HIP failures.
D.The DNS server configuration in the GlobalProtect portal agent configuration for the user's region.
AnswerD

If the user can access internal resources by IP but not by hostname, DNS resolution is failing. The GlobalProtect portal agent configuration specifies the DNS servers pushed to clients. If the DNS server list for the user's region is incorrect or missing, the user cannot resolve internal hostnames. Verifying this configuration is the logical first step.

Why this answer

The ability to reach internal servers by IP but not by hostname indicates a DNS resolution problem. In Prisma Access, DNS settings for mobile users are pushed via the GlobalProtect portal agent configuration. If the DNS servers for the user's region are misconfigured or missing, the user cannot resolve internal hostnames.

Verifying the DNS server configuration is the correct first step.

Exam trap

The trap here is jumping to security policy or decryption checks when the split between IP and hostname access clearly isolates the problem to name resolution.

Practice this question →
31
Multi-Selecthard

An enterprise network administrator is troubleshooting an IPsec tunnel failure between a remote network and Prisma Access where Dead Peer Detection (DPD) keeps tearing down the tunnel. Which THREE potential causes should be investigated? (Choose three)

Select 3 answers
A.The GlobalProtect client software license is expired on Panorama.
B.Mismatched DPD interval and retry timer settings between the customer CPE and the Prisma Access node.
C.Intermediate network devices dropping UDP or ICMP keepalive packets required for DPD.
D.WildFire cloud analysis subscription has lapsed.
E.High packet loss or extreme latency on the transport path causing DPD timeouts.
AnswersB, C, E

DPD tears down tunnels when peers disagree on interval and retry timers, because one side declares the peer dead before the other responds. Aligning these values between the customer CPE and the Prisma Access node prevents spurious teardown of an otherwise healthy IPsec tunnel.

Why this answer

Option B is correct because DPD relies on matching timers: if the customer CPE's DPD interval/retry values differ from those configured on the Prisma Access IKE gateway, one side may declare the peer dead before the other responds, tearing down the IPsec tunnel. Option C is correct because DPD probes are carried as IKEv2 informational messages over UDP 500/4500 (or ICMP-based keepalives in some designs), so any intermediate firewall, NAT device, or ISP that drops or rate-limits those packets will cause false peer-death detection and tunnel teardown. Option E is correct because DPD is timeout-based: sustained packet loss or extreme latency on the transport path can delay or lose the DPD probes/acknowledgements so the retry timer expires, triggering the tunnel to be torn down even though the peer is actually alive.

Option A is not relevant because GlobalProtect client licensing on Panorama has no bearing on site-to-site IPsec DPD behavior, and Option D is not relevant because WildFire is a file-analysis subscription and does not affect IKE/DPD keepalive processing.

Exam trap

SSE-Engineer often tests whether candidates blame unrelated subscriptions (WildFire, GlobalProtect licensing) for tunnel failures — the trap is picking licensing/subscription options when the symptom is specifically DPD keepalive teardown, which is a transport or timer issue.

Practice this question →
32
MCQeasy

An administrator needs to verify the exact version of Prisma Access running on the cloud infrastructure. Where in Panorama is this version information displayed?

A.Policies > Security.
B.Device > Certificates.
C.Monitor > Dynamic Updates.
D.Panorama > Cloud Services > Setup > Infrastructure / Status.
AnswerD

The Cloud Services infrastructure status page exposes the running Prisma Access tenant version, since the cloud infrastructure is managed by Palo Alto rather than on-premises Panorama. This is the only location displaying the deployed cloud version.

Why this answer

Prisma Access infrastructure version information is displayed under Panorama > Cloud Services > Setup > Infrastructure / Status, where the cloud service plugin shows the current Prisma Access version, tenant status, and component versions. This is the authoritative location for verifying the running cloud infrastructure version.

Exam trap

SSE-Engineer often tests whether candidates confuse Dynamic Updates (content/signature versions) with the Cloud Services Infrastructure/Status page that shows the actual Prisma Access infrastructure version.

How to eliminate wrong answers

Option A is wrong because Policies > Security is where security rules are configured, not where infrastructure version data is displayed. Option B is wrong because Device > Certificates manages certificates for the firewall/Panorama, not Prisma Access cloud infrastructure versions. Option C is wrong because Monitor > Dynamic Updates shows content, App-ID, and threat signature update status, not the Prisma Access infrastructure version.

Practice this question →
33
Multi-Selectmedium

Which TWO actions should an administrator perform when troubleshooting User-ID mapping failures for mobile users in Prisma Access? (Choose two)

Select 2 answers
A.Verify that GlobalProtect is configured to report user mappings and check authentication log status.
B.Restart the physical firewall hardware in the branch office.
C.Change the WildFire signature update schedule.
D.Modify the QoS bandwidth allocation profile.
E.Use the CLI command 'show user ip-user-mapping all' to verify if active user-to-IP mappings are populated.
AnswersA, E

Mobile users depend on GlobalProtect to send user-to-IP mappings to Prisma Access. Verifying that the agent reports mappings and that authentication logs show successful logins isolates whether the failure is a reporting or authentication problem, satisfying the troubleshooting requirement.

Why this answer

Option A is correct because User-ID mapping for mobile users in Prisma Access depends on GlobalProtect reporting user mappings to the User-ID service; the administrator must confirm GlobalProtect is configured to send those mappings and review authentication logs to see whether authentication succeeded or failed. Option E is correct because the CLI command 'show user ip-user-mapping all' displays the current user-to-IP mappings on the firewall, allowing the administrator to verify whether active mappings are actually populated. Options B, C, and D are not relevant: restarting branch firewall hardware, changing WildFire signature update schedules, and modifying QoS bandwidth profiles do not address User-ID mapping or authentication reporting for mobile users.

Exam trap

SSE-Engineer often tests the misconception that infrastructure restarts or unrelated security subscriptions (WildFire, QoS) resolve identity issues, when User-ID troubleshooting always centers on GlobalProtect reporting and the mapping table.

Practice this question →
34
MCQmedium

A remote network connected via Prisma Access is experiencing packet drops due to Maximum Transmission Unit (MTU) size mismatches. Which troubleshooting technique or configuration should be verified to resolve IP packet fragmentation issues?

A.Change the mobile user authentication type from SAML to RADIUS.
B.Enable TCP MSS clamping on the IPsec tunnel settings or ensure the local CPE device correctly handles ICMP Destination Unreachable messages.
C.Configure a WildFire analysis profile to bypass large files.
D.Increase the GlobalProtect client idle timeout value to 3600 seconds.
AnswerB

MSS clamping rewrites the TCP maximum segment size so packets fit the tunnel MTU, preventing fragmentation before it occurs. Correctly handling ICMP Destination Unreachable (fragmentation needed) lets endpoints discover the path MTU, resolving the drops.

Why this answer

MTU mismatches cause fragmentation issues when packets exceed the path MTU and ICMP 'fragmentation needed' messages are blocked. Enabling TCP MSS clamping on the IPsec tunnel forces the maximum segment size to fit within the tunnel MTU, preventing fragmentation, while ensuring the CPE handles ICMP Destination Unreachable (Type 3, Code 4) allows Path MTU Discovery to function correctly.

Exam trap

SSE-Engineer often tests confusing MTU/fragmentation issues with authentication or policy problems, leading candidates to pick irrelevant options like changing auth type or timeout values.

How to eliminate wrong answers

Option A is wrong because authentication type (SAML vs RADIUS) has no bearing on packet fragmentation or MTU. Option C is wrong because WildFire analysis profiles inspect files for malware and do not affect MTU or fragmentation behavior. Option D is wrong because GlobalProtect idle timeout controls session lifetime, not packet size or fragmentation.

Practice this question →
35
Multi-Selectmedium

Which TWO logs should an administrator check in Panorama when troubleshooting a mobile user who reports that their connection keeps dropping after a short period of time? (Choose two)

Select 2 answers
A.Monitor > Logs > Traffic to check for session timeouts, TCP resets, or security policy drops.
B.Monitor > Logs > Threat.
C.Monitor > Logs > GlobalProtect to view client connection events, gateway reconnects, and error messages.
D.Panorama > Cloud Services > Audit Log.
E.Monitor > Logs > Data Filtering.
AnswersA, C

Traffic logs record session end reasons, so timeouts, TCP resets and policy drops appear here, directly evidencing why a mobile user's connection terminates after a short period. This log therefore satisfies the stem's requirement to identify the cause of repeated drops.

Why this answer

Option A is correct because Monitor > Logs > Traffic in Panorama records session details such as session end reasons, TCP resets, and security policy drops, which can reveal whether the mobile user's connection is being torn down by a timeout, reset, or deny rule. Option C is correct because Monitor > Logs > GlobalProtect captures GlobalProtect client connection events, gateway reconnects, and error messages, which directly show why a mobile user's tunnel keeps dropping after a short period. Option B is not appropriate here because Monitor > Logs > Threat shows security threat detections, not the connection-drop events described.

Option D is not appropriate because Panorama > Cloud Services > Audit Log records cloud service and configuration audit activity, not user tunnel connectivity. Option E is not appropriate because Monitor > Logs > Data Filtering pertains to data filtering profile matches, not GlobalProtect connection stability.

Exam trap

SSE-Engineer often tests the assumption that a single log source (usually Traffic) is sufficient, when in fact tunnel/control-plane issues only appear in GlobalProtect logs.

Practice this question →
36
MCQhard

A Prisma Access mobile user experiences a scenario where specific internal domains fail to resolve when connected via GlobalProtect, while other internal domains resolve successfully. The split-DNS configuration in Panorama lists multiple domains. What is the most likely reason for this partial DNS failure?

A.The GlobalProtect portal SSL certificate is expired.
B.WildFire cloud connectivity is down.
C.BGP route reflection is misconfigured on the Service Connection.
D.Improperly formatted domain suffixes or exceeding the maximum number of supported split-DNS search domains for the client operating system.
AnswerD

Split-DNS resolution fails partially when suffix entries are malformed or the client OS search-domain limit is exceeded, so only some internal domains resolve. Correcting suffix formatting and reducing entries below the OS maximum restores resolution for the affected domains.

Why this answer

Split-DNS in GlobalProtect allows administrators to specify which DNS suffixes should be resolved by internal DNS servers versus public DNS. Partial resolution failures typically occur when the configured domain suffixes are improperly formatted (e.g., missing leading dot, wrong syntax) or when the total number of split-DNS search domains exceeds the maximum supported by the client OS — Windows and macOS have limits on search domain list length. Domains beyond that limit are silently ignored, causing only some internal domains to resolve.

Exam trap

SSE-Engineer often tests the assumption that any split-DNS failure is a certificate or connectivity issue, when the real cause is usually OS-level limits on search domain count or malformed suffix entries.

How to eliminate wrong answers

Option A is wrong because an expired portal SSL certificate would prevent the GlobalProtect tunnel from establishing at all, not cause selective DNS resolution failures for some internal domains. Option B is wrong because WildFire cloud connectivity is unrelated to DNS resolution of internal domains — WildFire handles file submission and analysis, not name resolution. Option C is wrong because BGP route reflection on the Service Connection affects routing between Prisma Access and on-premises networks, not DNS query forwarding or suffix matching on the endpoint.

Practice this question →
37
MCQmedium

A Prisma Access administrator is investigating why a specific mobile user is unable to access a web application that is allowed by a security policy. The administrator suspects that the user is being blocked by a URL Filtering profile. Which log type should the administrator check first to confirm the block?

A.Data Filtering logs
B.Threat logs
C.Traffic logs
D.URL Filtering logs
AnswerD

URL Filtering logs specifically record the URL category, the action taken (allow, block, alert), and the matched profile. This is the most direct way to confirm if a URL Filtering profile blocked the user's access. These logs are generated when a session matches a URL Filtering policy.

Why this answer

URL Filtering logs are the correct logs to check because they contain the URL category, the action taken, and the profile that matched. This directly confirms whether a URL Filtering profile blocked the user's access. Other log types do not provide this specific information.

Exam trap

The trap here is assuming that traffic logs show URL filtering details, when they only show session-level allow/deny without category context.

Practice this question →
38
MCQhard

An administrator implements a new Decryption policy in Prisma Access to inspect inbound traffic to a public-facing application hosted behind a Prisma Access Public IP. After deployment, users report receiving certificate warning errors. What should the administrator inspect first to resolve the warning?

A.Check whether the GlobalProtect client version on the user's laptop is up to date.
B.Ensure that WildFire analysis is disabled for inbound decrypted traffic.
C.Verify that the correct server certificate and private key are imported into Panorama and bound to the Inbound Decryption rule.
D.Verify the OCSP responder settings under Device > Setup > Sessions.
AnswerC

Inbound decryption terminates TLS at Prisma Access, which then re-encrypts to the backend using a certificate bound to the rule. If that server certificate and private key are missing or mismatched in Panorama, clients receive warnings, so verify the binding first.

Why this answer

When inbound decryption is configured for a public-facing application behind a Prisma Access Public IP, the firewall acts as a reverse proxy and must present a server certificate that matches the application's FQDN. If the wrong certificate or private key is bound to the Inbound Decryption rule, users receive certificate warnings. The first thing to verify is that the correct server certificate and private key are imported into Panorama and bound to the rule.

Exam trap

The trap is assuming the issue is client-side (GlobalProtect version) or related to OCSP, when the most common cause of certificate warnings in inbound decryption is a mismatched or missing server certificate bound to the rule.

How to eliminate wrong answers

Option A is wrong because the GlobalProtect client version is irrelevant to inbound decryption for a public-facing application — users accessing the app are not necessarily using GlobalProtect. Option B is wrong because WildFire analysis settings do not affect certificate presentation; disabling WildFire would not resolve certificate warnings. Option D is wrong because OCSP responder settings under Device > Setup > Sessions affect certificate revocation checking for outbound decryption, not the server certificate presented for inbound decryption.

Practice this question →
39
MCQhard

A security administrator is troubleshooting a Prisma Access mobile user who cannot access an internal application hosted in a branch office. The user is connected via GlobalProtect and can reach the internet. The administrator has verified that the user's security policy allows the traffic. Which step should the administrator take next to diagnose the issue?

A.Verify that the internal application's IP address is included in the mobile user's split tunnel configuration.
B.Review the Service Connection status and routing to ensure that the branch office network is reachable from Prisma Access.
C.Check the GlobalProtect app logs on the user's device for tunnel errors.
D.Confirm that the user's device has the correct DNS servers configured to resolve the internal application's hostname.
AnswerB

For mobile users to access internal applications in a branch office, Prisma Access must have a route to that branch office network. This is typically via a Service Connection or remote network tunnel. If the Service Connection is down or routing is misconfigured, traffic will be dropped. Checking this is crucial because internet access working does not guarantee internal network reachability.

Why this answer

Mobile users accessing internal applications require Prisma Access to route traffic to the branch office network. This is achieved through Service Connections or remote network tunnels. If the Service Connection is down or the branch office network is not advertised, traffic will fail.

Verifying Service Connection status and routing ensures that Prisma Access can forward traffic to the correct destination, which is essential before investigating client-side issues.

Exam trap

The trap here is focusing on client-side configurations like split tunnel or DNS when the problem is likely in Prisma Access routing to the internal network.

Practice this question →
40
MCQmedium

A network engineer is configuring a new Remote Network in Prisma Access and needs to ensure that traffic from the branch office to the internet is breakout locally rather than backhauled to headquarters. How is local internet breakout verified in Prisma Access?

A.Verify the BGP AS number on the Service Connection.
B.Verify that 'Local Internet Breakout' is enabled in the Remote Network configuration and examine Traffic logs to confirm internet-bound sessions egress through the Remote Network's assigned public IP.
C.Ensure SSL Forward Proxy is disabled on the Security Policy.
D.Check the GlobalProtect Portal client configuration settings.
AnswerB

Enabling Local Internet Breakout on the Remote Network sends internet-bound traffic directly out the branch's assigned public IP rather than through headquarters. Traffic logs confirm this by showing sessions egressing via that IP, proving local breakout is functioning.

Why this answer

Local internet breakout in Prisma Access is verified by confirming the 'Local Internet Breakout' setting is enabled in the Remote Network configuration and then examining Traffic logs to ensure internet-bound sessions egress through the Remote Network's assigned public IP rather than being backhauled to headquarters. This directly validates both the configuration intent and the actual traffic path. The Traffic logs show source and destination NAT details, egress interface, and the public IP used, providing definitive proof of local breakout.

Exam trap

The trap here is confusing routing protocol verification (BGP AS number) or security features (SSL Forward Proxy) with the actual mechanism for local internet breakout; candidates must focus on the specific configuration setting and traffic log evidence that proves egress path.

How to eliminate wrong answers

Option A is wrong because the BGP AS number on the Service Connection relates to routing peering between Prisma Access and the remote network, not to internet breakout behavior; it does not indicate whether internet traffic egresses locally. Option C is wrong because SSL Forward Proxy is a security inspection feature for outbound SSL traffic and has no bearing on whether internet breakout occurs locally or is backhauled. Option D is wrong because GlobalProtect Portal client configuration settings govern how mobile users connect and authenticate, not how branch (Remote Network) internet traffic is routed.

Practice this question →
41
MCQhard

A Prisma Access deployment utilizes Service Connections to connect to a corporate data center. An administrator notices that traffic destined for internal data center subnets is being sent out to the internet instead of the Service Connection. What is the most likely cause of this routing misconfiguration?

A.WildFire inspection is enabled on the security policy rule.
B.Missing or incorrect static routes / BGP route advertisements for the internal subnets in the Service Connection routing configuration.
C.The Security Predefined Policy rule order is incorrect.
D.The GlobalProtect Portal client timeout is set too low.
AnswerB

Service Connections forward traffic only for prefixes present in their routing table. Without correct static routes or BGP advertisements covering the internal subnets, Prisma Access has no matching route and falls back to the internet default path.

Why this answer

Service Connections in Prisma Access require explicit routing configuration — either static routes or BGP advertisements — to direct traffic for internal data center subnets over the Service Connection tunnel. If those routes are missing or incorrect, Prisma Access has no path for the internal subnets and falls back to the default route, sending the traffic out to the internet.

Exam trap

SSE-Engineer often tests the separation of routing from security policy, so the trap is blaming a security rule or WildFire profile when the symptom is clearly a path-selection (routing) problem.

How to eliminate wrong answers

Option A is wrong because WildFire inspection is a security profile action applied to allowed traffic; it does not influence routing decisions or cause traffic to bypass a Service Connection. Option C is wrong because predefined security policy rule order affects whether traffic is permitted or denied, not which egress path (Service Connection vs. internet) is selected. Option D is wrong because the GlobalProtect portal client timeout governs how long a client session can remain idle before re-authentication, and has no relationship to data center subnet routing.

Practice this question →
42
Multi-Selectmedium

A Prisma Access administrator is troubleshooting a Service Connection that repeatedly flaps, causing intermittent loss of access to internal applications for both mobile users and remote networks. The IPsec tunnel to the data center establishes but drops within minutes. Which TWO items should the administrator verify to isolate the cause? (Choose two.)

Select 2 answers
A.Confirm that the IKE and IPsec proposals on both peers match exactly, including encryption, hash, and DH group settings.
B.Verify that the GlobalProtect portal certificate chain is valid and not expired.
C.Confirm that URL Filtering profiles are attached to the remote network security policy.
D.Review the number of HIP profiles assigned to mobile users to reduce tunnel load.
E.Check the dead peer detection and rekey timers on both ends to ensure they are compatible and not expiring prematurely.
AnswersA, E

A mismatch in IKE or IPsec proposal parameters can allow the tunnel to negotiate initially yet fail on rekey, producing a tunnel that establishes and then drops within minutes. Verifying that encryption, hash, and Diffie-Hellman settings match on both peers directly addresses the intermittent flap. Aligned proposals ensure both phases negotiate and rekey reliably, which is essential for a stable Service Connection.

Why this answer

A tunnel that establishes then drops within minutes typically points to phase 2 negotiation or timing issues. Mismatched IKE or IPsec proposals fail at rekey, and incompatible dead peer detection or lifetime timers cause premature teardown. Verifying both parameter sets on each peer isolates the cause and stabilizes the Service Connection for all dependent users.

Exam trap

The trap here is chasing content-inspection or client-side settings when a tunnel that comes up and then drops points squarely at IPsec negotiation and timer compatibility.

Practice this question →
43
Multi-Selectmedium

Which TWO logs or monitoring views in Panorama are essential when troubleshooting a remote network user's inability to reach a specific cloud application via Prisma Access? (Choose two)

Select 2 answers
A.Panorama > Cloud Services > Audit Log.
B.Device > Setup > Management.
C.Monitor > ACC (Application Command Center) to analyze application traffic behavior and usage trends.
D.Objects > Addresses.
E.Monitor > Logs > Traffic to verify if sessions are allowed, denied, or timed out.
AnswersC, E

ACC aggregates application traffic by App-ID, letting you confirm whether the cloud application is being identified and permitted, or silently blocked by a security policy or decryption profile. It satisfies the need to analyse application-level behaviour for the specific unreachable app.

Why this answer

Option C is correct because Monitor > ACC (Application Command Center) in Panorama aggregates Prisma Access traffic and provides application-level visibility, letting you analyze whether the specific cloud application's traffic is being seen, how it is being categorized, and usage/behavior trends that reveal policy or App-ID mismatches. Option E is correct because Monitor > Logs > Traffic shows the actual session detail for Prisma Access traffic, including whether the flow was allowed, denied, or timed out, along with the matching security policy, source/destination, and application, which is essential to pinpoint where the remote user's connection fails. Option A is not appropriate because the Cloud Services Audit Log records administrative and configuration change events in the Prisma Access cloud service, not end-user application traffic.

Option B is not appropriate because Device > Setup > Management is a configuration area for Panorama management settings, not a log or monitoring view. Option D is not appropriate because Objects > Addresses is an address object configuration page, not a troubleshooting log or monitoring view.

Exam trap

SSE-Engineer often tests the distinction between configuration views (Objects, Device Setup) and monitoring views (Traffic logs, ACC), luring candidates to pick configuration panes when the question asks for troubleshooting logs.

Practice this question →
44
MCQeasy

An administrator needs to review configuration changes made to Prisma Access settings in Panorama over the past week to determine who modified a security policy. Which log should the administrator examine?

A.Monitor > Logs > Threat.
B.Monitor > Logs > Config.
C.Monitor > Logs > Data Filtering.
D.Monitor > Logs > Traffic.
AnswerB

Config logs in Panorama record administrative configuration changes, including the administrator identity and timestamp. Reviewing Monitor > Logs > Config therefore reveals who modified the security policy during the past week, matching the audit requirement.

Why this answer

The Config log (Monitor > Logs > Config) records all configuration changes made in Panorama, including who made the change, when, and what was modified. This is the correct log to review to determine who altered a security policy over the past week.

Exam trap

SSE-Engineer often tests the difference between the Config log (administrative changes) and the Traffic/Threat logs (network/security events) — candidates may pick Traffic log thinking it shows policy changes.

How to eliminate wrong answers

Option A is wrong because the Threat log records security events (exploits, malware, URL blocks), not configuration changes. Option C is wrong because the Data Filtering log records sensitive data pattern matches, not administrative actions. Option D is wrong because the Traffic log records session flows (allowed/denied traffic), not configuration modifications.

Practice this question →
45
MCQmedium

A network engineer is troubleshooting why a specific security policy rule configured in Panorama is not matching traffic in a Prisma Access environment. Which Panorama testing tool simulates traffic against security rules to verify rule evaluation?

A.Review the Audit log for policy changes.
B.Check the ACC top threats widget.
C.Run 'show system state'.
D.Use the Panorama CLI command 'test security-policy-match source <ip> destination <ip> application <app>'
AnswerD

The CLI 'test security-policy-match' command evaluates a synthetic flow against the compiled rulebase and returns the matching rule, so it isolates whether policy logic or another factor blocks traffic. This satisfies the stem's need to verify rule evaluation for a specific source, destination and application.

Why this answer

The correct tool is the Panorama CLI command 'test security-policy-match source <ip> destination <ip> application <app>' (D). This command simulates traffic against the security policy rulebase and shows which rule would match, including the rule name, action, and other details. It is the standard method for verifying rule evaluation in Prisma Access and Panorama-managed environments.

Exam trap

SSE-Engineer often tests the specific CLI command for policy simulation — candidates may confuse it with log review or system state commands, but the key is to remember that 'test security-policy-match' is the dedicated tool for simulating rule evaluation.

How to eliminate wrong answers

Option A is wrong because the Audit log records configuration changes, not policy evaluation results; it cannot tell you why a specific traffic flow did not match a rule. Option B is wrong because the ACC top threats widget displays threat analytics and trends, not rule matching simulation. Option C is wrong because 'show system state' displays system-level operational state (e.g., HA status, process states), not security policy evaluation.

Practice this question →
46
Multi-Selectmedium

Which TWO configuration steps should an administrator verify when troubleshooting an issue where Panorama cannot push updates or configurations to Prisma Access nodes? (Choose two)

Select 2 answers
A.Check Panorama > Job Status to review specific error codes and failed configuration push tasks.
B.Verify that Panorama has active cloud services communication and valid management certificates to reach Prisma Access cloud infrastructure.
C.Restart the CPE device at the branch office.
D.Update the URL Filtering database manually.
E.Modify the NAT policy rules on the remote firewall.
AnswersA, B

Panorama's Job Status page records each configuration push task and its associated error codes. Reviewing failed tasks there exposes the specific reason a push to Prisma Access nodes did not complete, directing the administrator to the underlying misconfiguration.

Why this answer

Option A is correct because Panorama > Job Status is the primary place to inspect configuration push jobs, their task IDs, and specific error codes when commits or pushes to Prisma Access fail, directly revealing why the push did not complete. Option B is correct because Panorama must maintain active cloud services communication and valid management certificates to authenticate to and reach the Prisma Access cloud infrastructure; broken connectivity or expired/invalid certificates will block pushes. Option C is not relevant because restarting a branch CPE device does not address Panorama-to-Prisma-Access push failures.

Option D is incorrect because manually updating the URL Filtering database is unrelated to configuration or update push failures from Panorama. Option E is incorrect because modifying NAT policy on a remote firewall does not resolve Panorama's inability to push updates or configurations to Prisma Access nodes.

Practice this question →
47
MCQeasy

A Prisma Access administrator needs to verify that a specific mobile user's traffic is being inspected by the correct security policy rule. The administrator wants to see the rule name that allowed or denied a recent session. Which log type should the administrator consult?

A.URL Filtering logs
B.Traffic logs
C.Threat logs
D.System logs
AnswerB

Traffic logs contain fields such as 'Rule' that indicate which security policy rule was applied to a session. By filtering for the user and the session details, the administrator can see the exact rule name and whether the action was allow or deny. This directly answers the question.

Why this answer

Traffic logs are the only log type that records the security policy rule name and action for each session. By filtering traffic logs for the specific user and session, the administrator can identify the exact rule that allowed or denied the traffic. Other log types serve different purposes and do not contain policy rule information.

Exam trap

The trap here is assuming that any log related to web traffic or security events will show the policy rule, when only traffic logs include the rule name field.

Practice this question →
48
Multi-Selectmedium

A Prisma Access engineer is troubleshooting a Service Connection that is not establishing. The engineer suspects that the issue is related to the Service Connection configuration or network reachability. Which two actions should the engineer perform to validate the Service Connection status and connectivity? (Choose two.)

Select 2 answers
A.Verify that the Service Connection is enabled and that the correct IPsec tunnel settings are configured in the Prisma Access portal.
B.Run a packet capture on the branch firewall to analyze IPsec traffic.
C.Check the IKE and IPsec logs on the branch firewall for any negotiation failures.
D.Verify that the branch firewall has a route to the Prisma Access Service IP addresses.
E.Check the Service Connection status in the Prisma Access dashboard to see if it is connected or if there are any errors.
AnswersA, E

The Service Connection must be enabled and properly configured with correct IPsec parameters (such as IKE and IPsec crypto profiles, and pre-shared keys) to establish tunnels. If it is disabled or misconfigured, the connection will fail. Checking these settings in the Prisma Access portal is a fundamental step to ensure the Service Connection is correctly provisioned and ready to accept or initiate tunnels.

Why this answer

To validate a Service Connection that is not establishing, the engineer should first verify that it is enabled and correctly configured in the Prisma Access portal. This ensures that the necessary parameters are in place. Second, checking the Service Connection status in the dashboard provides immediate feedback on whether the connection is up or down, and often includes error details.

These two actions are the quickest way to confirm the state and identify misconfigurations.

Exam trap

The trap here is diving into packet captures or logs before verifying basic configuration and dashboard status, which are faster and more definitive for initial validation.

Practice this question →
49
MCQmedium

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

A.Policies > NAT.
B.Panorama > Cloud Services > Audit Log.
C.Monitor > Logs > System or Authentication logs in Panorama.
D.Monitor > Logs > Threat.
AnswerC

Panorama's System and Authentication logs capture RADIUS timeout and communication errors generated by the mobile users' GlobalProtect authentication path, satisfying the requirement to locate these events centrally. System logs record daemon-level failures, while Authentication logs detail per-user RADIUS exchanges, so both must be inspected to diagnose the failing authentication.

Why this answer

RADIUS authentication failures and timeouts are logged in the System and Authentication logs in Panorama (Monitor > Logs). These logs capture the authentication request, response, and any timeout or communication errors with the RADIUS server. This is the correct place to diagnose the failure.

Exam trap

SSE-Engineer often tests whether candidates know which log type (System/Authentication) contains RADIUS errors versus Threat or Audit logs that serve different purposes.

How to eliminate wrong answers

Option A is wrong because NAT policies govern address translation and do not log authentication errors. Option B is wrong because the Cloud Services Audit Log records administrative and configuration actions in Prisma Access, not runtime RADIUS authentication events. Option D is wrong because Threat logs record security events like exploits and malware, not authentication timeouts.

Practice this question →
50
MCQeasy

A security administrator needs to check real-time threat logs for a specific Prisma Access mobile user who reports being blocked from accessing a malicious file. Which Panorama menu path provides the most direct access to these logs?

A.Panorama > Cloud Services > Setup > Management.
B.Prisma Access > Service Setup > Locations.
C.Policies > Security.
D.Monitor > Logs > Threat.
AnswerD

Monitor > Logs > Threat displays threat signatures and verdicts in real time, letting the administrator filter by the specific mobile user to see why the malicious file was blocked. Other log types lack threat verdict detail.

Why this answer

Real-time threat logs in Panorama are accessed via Monitor > Logs > Threat, which aggregates threat logs from all managed firewalls, including Prisma Access mobile user traffic. This is the most direct path to view detailed threat events such as blocked malicious file downloads for a specific user.

Exam trap

SSE-Engineer often tests whether candidates know that log viewing is always under the Monitor tab, not under configuration menus like Cloud Services or Policies.

How to eliminate wrong answers

Option A is wrong because Panorama > Cloud Services > Setup > Management configures management settings, not log viewing. Option B is wrong because Prisma Access > Service Setup > Locations configures service locations, not logs. Option C is wrong because Policies > Security is for defining security rules, not for viewing logs.

Practice this question →
51
Multi-Selectmedium

Which TWO troubleshooting methods are effective when verifying whether Host Information Profile (HIP) checks are operating correctly for Prisma Access mobile users? (Choose two)

Select 2 answers
A.Modify the NAT policy rules.
B.Restart the physical branch firewall.
C.Check GlobalProtect client settings in Panorama to ensure HIP report generation and submission intervals are correctly configured.
D.Monitor > Logs > HIP Match to review successful and failed compliance evaluations.
E.Update the URL Filtering database.
AnswersC, D

HIP reports only reach Prisma Access if the GlobalProtect client generates and submits them at the configured intervals. Checking these settings in Panorama confirms the reporting mechanism itself is enabled, which is a prerequisite before any compliance evaluation can occur.

Why this answer

Option C is correct because HIP checks on Prisma Access mobile users depend on the GlobalProtect client generating and submitting HIP reports, and those behaviors are governed by the HIP report generation and submission interval settings configured in the GlobalProtect agent settings in Panorama; verifying these settings confirms the client is actually sending HIP data for evaluation. Option D is correct because the Monitor > Logs > HIP Match log records the results of HIP-based compliance evaluations, showing which HIP profiles matched or failed for each user/device, which is the direct way to verify that HIP checks are operating correctly. Option A is incorrect because NAT policy rules only affect address translation and have no bearing on HIP report generation or evaluation.

Option B is incorrect because restarting a physical branch firewall is irrelevant to Prisma Access mobile user HIP checks, which are enforced in the Prisma Access cloud infrastructure. Option E is incorrect because updating the URL Filtering database affects web content inspection, not HIP check functionality.

Exam trap

SSE-Engineer often tests the misconception that HIP troubleshooting requires network-layer changes (NAT, firewall restarts) when the actual verification points are client configuration and HIP Match logs.

Practice this question →
52
Multi-Selecthard

A Prisma Access engineer is troubleshooting a mobile user who cannot access an internal application after successfully connecting via GlobalProtect. The engineer suspects that the issue is related to the split-tunnel configuration. Which TWO actions should the engineer take to verify that the correct routes are being pushed to the client? (Choose two.)

Select 2 answers
A.Run a packet capture on the Prisma Access service connection to see if traffic arrives.
B.Verify the user's authentication and group mapping in the Prisma Access directory sync.
C.Review the GlobalProtect agent logs on the user's endpoint for the received route table.
D.Inspect the IPsec tunnel status between the service connection and the remote network.
E.Check the GlobalProtect gateway configuration in Prisma Access for the split-tunnel access routes.
AnswersC, E

The GlobalProtect agent logs on the endpoint record the routes and DNS settings pushed by the gateway during connection. By examining these logs, the engineer can see if the internal subnet is included in the split-tunnel routes. If the route is missing, the client will not send traffic for that subnet through the tunnel, causing access failure. This is a direct method to verify the client's effective routing table.

Why this answer

To diagnose split-tunnel routing issues for a mobile user, the engineer must confirm both the intended configuration and the actual client behavior. The gateway configuration defines which routes should be pushed, while the client logs show which routes were received. If either is missing the internal subnet, the user cannot access the application.

These two actions together isolate whether the problem is in the configuration or in the client's application of the routes.

Exam trap

The trap here is focusing on server-side packet captures or tunnel status when the issue is actually client-side routing due to split-tunnel configuration.

Practice this question →
53
MCQmedium

An administrator notices that users connecting via Prisma Access Remote Networks are unable to reach a specific internal application hosted in the corporate datacenter. The traffic is dropped by Prisma Access. Which tool in Panorama should the administrator use first to verify if the security policy is matching and blocking the traffic in real-time?

A.GlobalProtect app diagnostics tab on the endpoint.
B.Prisma Access Insight path quality monitoring.
C.Traffic Logs with a filter for the source user and destination IP, checking the 'Drop Reason' field.
D.Panorama Dynamic Updates status page.
AnswerC

Traffic logs record each session's policy match and include a Drop Reason field, letting the administrator confirm in real time whether a security rule blocked the flow. Filtering by source user and destination IP isolates the affected application traffic immediately.

Why this answer

Traffic Logs in Panorama are the authoritative source for confirming whether a session was allowed or denied by security policy, and the 'Drop Reason' field explicitly identifies policy-based drops (e.g., 'policy-deny', 'rule match'). Filtering by source user and destination IP isolates the specific flow in question and shows the matching rule in real time. This directly answers whether the security policy is the cause of the drop.

Exam trap

SSE-Engineer often tests whether candidates confuse connectivity/path monitoring tools (Insight, GlobalProtect diagnostics) with the actual policy enforcement evidence found in Traffic Logs and the Drop Reason field.

How to eliminate wrong answers

Option A is wrong because GlobalProtect app diagnostics on the endpoint only show tunnel/connectivity state and local client logs — they cannot reveal Panorama security policy matches or drop reasons for traffic already forwarded to Prisma Access. Option B is wrong because Prisma Access Insight path quality monitoring reports latency, jitter, and packet loss on the SD-WAN/backbone path, not security policy enforcement decisions. Option D is wrong because the Dynamic Updates status page shows content/App-ID/Threat signature versions and update success, which is unrelated to per-session policy evaluation.

Practice this question →
54
MCQhard

Users connected through a Prisma Access remote network report that traffic to a partner's public web application is being blocked, while the same application works from a mobile user tunnel. The administrator confirms a URL Filtering profile is applied to both the remote network and mobile user policies. Which log type and filter should the administrator use to determine why the remote network traffic is blocked?

A.Traffic logs filtered by the remote network source and destination, to check whether the session is allowed or denied at the firewall stage.
B.Data Filtering logs filtered by the application and the file direction to identify the blocked transfer.
C.Authentication logs filtered by the remote network users to confirm group mapping succeeded.
D.URL Filtering logs filtered by the remote network users and the partner destination, to identify the matched category and action.
AnswerD

URL Filtering blocks are recorded in URL Filtering logs, which show the URL category, the matched profile, and the action taken. Because mobile users succeed while remote network users fail, the difference is likely in which profile or category configuration applies to the remote network path. Filtering URL logs by those users and the destination reveals the exact category and rule causing the block.

Why this answer

A URL Filtering block is captured in URL Filtering logs, which record the category, matched profile, and action. Since mobile users succeed and remote network users fail, the discrepancy lies in whichever URL Filtering profile applies to the remote network path. Filtering URL logs by those users and the partner destination surfaces the exact category and rule responsible.

Exam trap

The trap here is treating a URL Filtering block as a generic deny and searching traffic logs, when the category decision and action only appear in URL Filtering logs.

Practice this question →
55
MCQeasy

An administrator needs to monitor the volume of traffic passing through a specific Prisma Access Service Connection. Which monitoring tool in Panorama displays aggregated data on bandwidth usage, top applications, and top users?

A.Panorama > Cloud Services > Audit Log.
B.Device > Log Settings.
C.Monitor > ACC (Application Command Center).
D.Policies > QoS.
AnswerC

Monitor > ACC in Panorama aggregates traffic logs into bandwidth usage, top applications, and top users, letting administrators inspect a specific Service Connection's throughput. It satisfies the requirement to monitor traffic volume and identify the heaviest consumers without manually parsing raw session logs.

Why this answer

The correct tool is Monitor > ACC (Application Command Center) (C). ACC provides aggregated dashboards showing bandwidth usage, top applications, top users, and other traffic analytics. It is designed for monitoring traffic patterns and volumes across the network, including Service Connections in Prisma Access.

Exam trap

SSE-Engineer often tests the difference between monitoring tools — candidates may confuse ACC with Audit Log or Log Settings, but ACC is the dedicated dashboard for traffic analytics and bandwidth monitoring.

How to eliminate wrong answers

Option A is wrong because Panorama > Cloud Services > Audit Log records configuration changes and administrative actions, not traffic volume or application usage. Option B is wrong because Device > Log Settings configures logging parameters, not monitoring dashboards. Option D is wrong because Policies > QoS is for quality of service policy configuration, not traffic monitoring.

Practice this question →
56
MCQhard

An enterprise deployment of Prisma Access utilizes Kerberos authentication for mobile users. Users report frequent authentication prompt failures when connecting via GlobalProtect from external networks. What is the most likely root cause of Kerberos authentication failure in this scenario?

A.WildFire cloud subscription has expired.
B.The decryption policy is missing an inbound rule.
C.The GlobalProtect client software license is invalid.
D.Lack of direct network line-of-sight or routing from the mobile user's remote location to the internal Active Directory Domain Controllers via a Service Connection.
AnswerD

Kerberos requires direct line-of-sight to a domain controller for ticket issuance, so remote GlobalProtect users off-network cannot reach internal Active Directory Domain Controllers unless a Service Connection provides routing. Without that path, ticket requests fail, producing the reported authentication prompt failures.

Why this answer

Kerberos requires the client to reach a Key Distribution Center (KDC) — typically an internal Active Directory Domain Controller — to obtain a Ticket Granting Ticket. A mobile user on an external network has no direct line-of-sight to internal DCs unless Prisma Access provides a Service Connection with routing to those DCs. Without that path, the Kerberos exchange cannot complete, causing authentication prompt failures.

Exam trap

SSE-Engineer often tests the misconception that Kerberos failures are caused by licensing or decryption, when the root cause is almost always loss of network reachability to the KDC.

How to eliminate wrong answers

Option A is wrong because WildFire is a malware analysis subscription and has no role in Kerberos authentication. Option B is wrong because a decryption policy inbound rule affects SSL inspection, not Kerberos ticket acquisition. Option C is wrong because GlobalProtect client licensing does not govern Kerberos authentication; even a valid license cannot overcome missing network reachability to the KDC.

Practice this question →
57
MCQeasy

A network administrator is troubleshooting a Prisma Access remote network deployment where users at a branch office are experiencing slow access to cloud applications. The administrator has verified that the IPsec tunnel is up and that there is no packet loss on the tunnel. Which tool should the administrator use to monitor the performance and latency of the Service Connection?

A.Panorama's Managed Devices health monitor
B.Prisma Access Dashboard's Service Connection health metrics
C.CLI commands on the remote network firewall to check tunnel statistics
D.GlobalProtect app logs on the branch office users' devices
AnswerB

The Prisma Access Dashboard provides health metrics for Service Connections, including latency, jitter, and packet loss. These metrics are specifically designed to monitor the performance of the connection between Prisma Access and the remote network or internet. This is the most appropriate tool to identify if the Service Connection is causing slow access to cloud applications.

Why this answer

The Prisma Access Dashboard's Service Connection health metrics are specifically designed to monitor the performance of Service Connections, including latency, jitter, and packet loss. When remote network users experience slow access to cloud applications despite a healthy IPsec tunnel, the bottleneck may be at the Service Connection. Using the dashboard metrics allows the administrator to quickly assess if the Service Connection is experiencing degraded performance.

Exam trap

The trap here is assuming that tunnel statistics on the remote firewall or Panorama health monitors provide Service Connection performance data, when only the Prisma Access Dashboard does.

Practice this question →
58
MCQhard

A Prisma Access administrator is troubleshooting a remote network site where IPsec tunnels are flapping. The administrator suspects that the tunnel monitoring settings are too aggressive. Which configuration parameter should be adjusted to reduce flapping?

A.Enable IKEv1 instead of IKEv2 for the remote network IPSec tunnel.
B.Modify the IPsec proposal encryption algorithms to use stronger ciphers.
C.Adjust the dead peer detection (DPD) interval and retry count on the remote network IPSec tunnel.
D.Increase the IKEv2 rekey timer on the remote network IPSec tunnel.
AnswerC

DPD detects if the peer is unreachable. If the DPD interval is too short or retry count too low, transient network issues can cause the tunnel to be torn down and re-established, leading to flapping. Increasing the DPD interval and retry count makes the tunnel more tolerant of brief disruptions, reducing unnecessary flapping. This directly addresses the suspected cause and is the correct parameter to adjust.

Why this answer

Tunnel flapping in remote network IPsec tunnels is often caused by overly aggressive dead peer detection (DPD) settings. If DPD intervals are too short or retry counts too low, temporary network latency or packet loss can trigger tunnel teardown and re-establishment. Adjusting these parameters to be more lenient allows the tunnel to withstand transient issues, reducing flapping.

This is the targeted solution for the described scenario.

Exam trap

The trap here is focusing on encryption or IKE version changes when the issue is actually about connectivity detection sensitivity, not cryptographic settings.

Practice this question →
59
MCQmedium

An administrator troubleshooting a Prisma Access mobile user connectivity issue wants to verify whether the GlobalProtect gateway is actively responding to client connection requests. Where can this real-time session and gateway status be verified?

A.Policies > Decryption.
B.Panorama > Cloud Services > Status > Mobile Users > Gateways.
C.Device > Setup > Operations.
D.Objects > Addresses.
AnswerB

Panorama's Cloud Services status page surfaces live gateway health and mobile user session data for Prisma Access, showing whether each GlobalProtect gateway is responding. This directly satisfies the requirement to verify real-time gateway responsiveness to client connection requests.

Why this answer

The status of GlobalProtect gateways for Prisma Access mobile users, including real-time session and gateway responsiveness, is verified under Panorama > Cloud Services > Status > Mobile Users > Gateways. This page shows gateway status, connected users, and health metrics for the Prisma Access mobile user infrastructure.

Exam trap

SSE-Engineer often tests the specific Panorama path for checking Prisma Access mobile user gateway status, and candidates may confuse it with general device operations or policy menus.

How to eliminate wrong answers

Option A is wrong because Policies > Decryption configures decryption policies, not gateway status. Option C is wrong because Device > Setup > Operations is for device operations like configuration backups, not for Prisma Access gateway status. Option D is wrong because Objects > Addresses manages address objects, unrelated to gateway status.

Practice this question →
60
MCQeasy

A Prisma Access administrator is troubleshooting a mobile user who reports that they cannot access any internal resources after connecting via GlobalProtect. The administrator checks the GlobalProtect status and sees that the user is connected. Which log should the administrator review first to determine why the user's traffic is being blocked?

A.System logs
B.Authentication logs
C.HIP match logs
D.Traffic logs
AnswerD

Traffic logs provide detailed information about the sessions initiated by the user, including the source, destination, application, and the security policy that was applied. When a user cannot access internal resources, the traffic logs will show whether the traffic is being allowed or denied and which rule is responsible. This is the most direct way to identify the cause of the block. Reviewing traffic logs is a fundamental first step in troubleshooting access issues.

Why this answer

Traffic logs are the most appropriate first source because they record every session and indicate which security policy was applied and whether the action was allow or deny. By examining the traffic logs, the administrator can see the exact rule that is blocking the user's traffic and the destination being accessed. This information is critical for determining whether the issue is due to a misconfigured security policy, a missing route, or another factor.

Exam trap

The trap here is assuming that authentication or HIP logs are the first place to look, but since the user is already connected, the block is likely at the policy enforcement stage, which is captured in traffic logs.

Practice this question →
61
Multi-Selecthard

An administrator is troubleshooting a Prisma Access environment where threat prevention profiles are failing to block known malicious file downloads. Which THREE settings or logs should the administrator investigate? (Choose three)

Select 3 answers
A.Check the Threat and WildFire logs to see if the files were inspected, logged, or bypassed due to exclusions.
B.Ensure that SSL Decryption is enabled for the traffic, as encrypted payloads cannot be inspected for malware signatures without decryption.
C.Check the BGP AS number on the Remote Network CPE.
D.Verify the GlobalProtect Portal client timeout setting.
E.Verify that Anti-Spyware, Antivirus, and WildFire analysis profiles are actively attached to the matching Security Policy rules.
AnswersA, B, E

Threat and WildFire logs record whether each file was inspected, logged or bypassed. Exclusions silently skip inspection, so a malicious download may never be scanned. Reviewing these logs reveals whether an exclusion or profile misconfiguration prevented blocking.

Why this answer

Option A is correct because the Threat and WildFire logs are the authoritative place to confirm whether a file was actually inspected, merely logged, or bypassed by a decryption exclusion or application override, which directly explains why malicious downloads are not being blocked. Option B is correct because SSL/TLS-encrypted payloads cannot be matched against antivirus or WildFire signatures unless SSL Decryption (forward proxy or inbound inspection) is applied to that traffic, so undecrypted sessions will silently pass malware. Option E is correct because a threat prevention profile only takes effect when the Anti-Spyware, Antivirus, and WildFire Analysis profiles are attached to the Security Policy rule that matches the traffic; if the rule references no profile or the wrong profile, files are never blocked.

Option C is not relevant because the BGP AS number on the Remote Network CPE only affects routing and tunnel establishment, not content inspection or file blocking. Option D is not relevant because the GlobalProtect Portal client timeout governs how long a client can remain disconnected before re-authentication, and has no bearing on threat prevention or file inspection.

Exam trap

SSE-Engineer often tests the prerequisites for threat inspection, and candidates may overlook SSL decryption or profile attachment, focusing instead on unrelated settings like BGP or client timeout.

Practice this question →
62
MCQmedium

A security administrator is troubleshooting a URL Filtering policy in Prisma Access where users are able to access a category that should be blocked. Which tool in Panorama should the administrator use to test and verify which URL category a specific website falls under and which policy rule applies?

A.Review the ACC top applications widget.
B.Check the GlobalProtect gateway connection status.
C.Use the URL Filtering lookup tool in Panorama or test via 'test url <website>' in the CLI.
D.Examine the System log for category update errors.
AnswerC

Panorama's URL Filtering lookup tool queries the cloud URL database directly, returning the category a site belongs to and the policy rule that matches. The CLI equivalent, 'test url <website>', performs the same check, confirming why a supposedly blocked category is permitted.

Why this answer

Panorama's URL Filtering lookup tool and the CLI 'test url <website>' command query the URL categorization database and show which category a site belongs to and which policy rule matches. This is the direct way to verify why a URL is or isn't being blocked. It removes guesswork from URL Filtering troubleshooting.

Exam trap

SSE-Engineer often tests whether candidates know the specific diagnostic tool (URL lookup / 'test url') versus generic monitoring widgets like ACC or logs that don't resolve categorization.

How to eliminate wrong answers

Option A is wrong because the ACC top applications widget shows application usage statistics, not URL category resolution or policy matching. Option B is wrong because GlobalProtect gateway connection status shows tunnel health, not URL categorization. Option D is wrong because System logs show category update errors but do not resolve a specific URL's category or policy match.

Practice this question →
63
MCQhard

An administrator is troubleshooting a Prisma Access mobile user environment where users are unable to connect because of an invalid certificate error presented by the GlobalProtect Portal. Which configuration element in Panorama should be verified?

A.Verify that the SSL/TLS certificate assigned to the GlobalProtect Portal configuration is valid, not expired, and trusted by the client devices.
B.Check the IPsec crypto profile under Network > Network Profiles > IPsec Crypto.
C.Check the User-ID agent connection timeout settings.
D.Verify the BGP AS number on the Remote Network node.
AnswerA

The portal presents its assigned SSL/TLS certificate during the GlobalProtect handshake; an expired, mismatched or untrusted certificate triggers the client's invalid certificate error. Verifying this element satisfies the stem's constraint that the failure originates at the portal's certificate configuration.

Why this answer

The GlobalProtect Portal presents an SSL/TLS certificate to connecting clients during the portal handshake. If that certificate is expired, self-signed without a trusted chain, or has a mismatched CN/SAN, clients will reject the connection with an invalid certificate error before any tunnel or authentication occurs. The correct remediation is to verify the certificate assigned under Panorama > Cloud Services > Prisma Access > GlobalProtect Portal configuration is valid and trusted by the endpoints.

Exam trap

SSE-Engineer often tests the distinction between portal/gateway SSL certificates and IPsec crypto profiles, so the trap is selecting a tunnel-encryption setting when the error is explicitly an SSL certificate validation failure at the portal.

How to eliminate wrong answers

Option B is wrong because IPsec crypto profiles govern Phase 1/Phase 2 tunnel parameters for site-to-site or service connections, not the SSL certificate presented by the GlobalProtect Portal during client login. Option C is wrong because User-ID agent timeout settings affect user-to-IP mapping freshness for policy enforcement, not certificate validation during portal connection. Option D is wrong because BGP AS numbers are relevant to dynamic routing between Prisma Access and remote networks or service connections, and have no bearing on the SSL certificate the portal presents to mobile users.

Practice this question →
64
Multi-Selecthard

An administrator is troubleshooting a Prisma Access deployment where specific applications are identified as 'incomplete' or 'unknown-tcp' in the Traffic logs. Which THREE factors or troubleshooting steps should be evaluated? (Choose three)

Select 3 answers
A.Verify the expiration date of the GlobalProtect gateway SSL certificate.
B.Check the WildFire subscription license key status.
C.Check for asymmetrical routing where traffic enters through one Prisma Access node/tunnel but exits through another.
D.Examine packet captures to determine if sessions are being terminated before the application handshake (three-way TCP handshake) completes.
E.Verify that security rules and service objects do not prematurely drop traffic before App-ID can inspect enough packets.
AnswersC, D, E

Asymmetrical routing prevents the firewall from seeing both sides of a handshake, leading to 'incomplete' sessions.

Why this answer

Option C is correct because Prisma Access App-ID requires that both directions of a flow traverse the same node/tunnel; asymmetrical routing causes the firewall to see only half the session, so the application cannot be identified and shows as incomplete or unknown-tcp. Option D is correct because App-ID needs to observe the full TCP three-way handshake and subsequent application data; if packet captures show the session is reset or terminated before the handshake completes, the firewall never gets enough context to classify the application. Option E is correct because overly restrictive security rules or service objects that drop traffic before App-ID has inspected sufficient packets will prevent identification, leaving the session logged as incomplete or unknown-tcp.

Option A is not relevant because the GlobalProtect gateway SSL certificate expiration affects user connectivity and authentication, not application identification in Traffic logs. Option B is not relevant because WildFire license status governs file submission and verdicts, not the App-ID classification of TCP sessions.

Exam trap

SSE-Engineer often tests whether candidates blame licensing or certificates for App-ID failures instead of the actual causes: incomplete handshakes, asymmetric routing, and premature policy drops.

Practice this question →
65
Multi-Selectmedium

Which TWO actions should an administrator take when troubleshooting an IPsec site-to-site tunnel failure between a customer CPE device and a Prisma Access Remote Network node? (Choose two)

Select 2 answers
A.Reconfigure the mobile user SAML authentication profile.
B.Disable all security policy rules across all remote locations.
C.Verify that IKE Phase 1 and Phase 2 proposal parameters (encryption, authentication, Diffie-Hellman groups) match between the CPE and Prisma Access node.
D.Restart the GlobalProtect agent on all remote user endpoints.
E.Check the System and operational logs in Panorama to identify exact IKE negotiation failure reasons.
AnswersC, E

IPsec negotiation fails outright when the two peers' IKE Phase 1 and Phase 2 proposals disagree on encryption, authentication or Diffie-Hellman group. Comparing these parameters on the CPE against the Prisma Access Remote Network node directly satisfies the stem's requirement to identify why the tunnel cannot establish.

Why this answer

Option C is correct because an IPsec site-to-site tunnel requires the IKE Phase 1 (ISAKMP) and Phase 2 (IPsec) proposals to be identical on both peers, including encryption algorithms (e.g., AES-256), authentication/hash (e.g., SHA-256), Diffie-Hellman groups (e.g., group 14), and lifetimes; any mismatch in these parameters causes the IKE negotiation to fail before the tunnel establishes. Option E is correct because Panorama collects the Prisma Access Remote Network node's System logs and operational IKE/IPsec logs, which record the exact negotiation failure reason (e.g., NO_PROPOSAL_CHOSEN, INVALID_KE_PAYLOAD, or phase-1/phase-2 mismatch), allowing the administrator to pinpoint the fault. Option A is not relevant because the mobile user SAML authentication profile applies to GlobalProtect user authentication, not to the IKE pre-shared-key or certificate authentication used by a site-to-site tunnel.

Option B is not appropriate because disabling security policy rules does not affect IKE/IPsec tunnel establishment and would unnecessarily remove enforcement across all remote locations. Option D is not relevant because the GlobalProtect agent runs on remote user endpoints and has no role in a CPE-to-Prisma Access Remote Network IPsec tunnel.

Exam trap

SSE-Engineer often tests the confusion between mobile user VPN troubleshooting (GlobalProtect/SAML) and site-to-site IPsec tunnel troubleshooting, causing candidates to select irrelevant mobile-user actions instead of focusing on IKE parameter matching and Panorama logs.

Practice this question →
66
MCQhard

A Prisma Access administrator is troubleshooting an issue where mobile users are unable to access a specific internal application after a recent change. The administrator suspects that the issue is related to the service connection's routing. The administrator runs 'show routing route' on the service connection and sees the route to the internal subnet is missing. The remote network's BGP configuration shows the subnet is being advertised. What is the most likely cause?

A.The service connection's BGP import policy is filtering out the route.
B.The internal subnet is not included in the service connection's static route configuration.
C.The BGP peer between the remote network and Prisma Access is down.
D.The remote network's BGP export policy is not allowing the subnet to be advertised.
AnswerA

Even if the remote network advertises the subnet, the service connection may have a BGP import policy that denies or filters the route. This would prevent the route from being installed in the routing table. Checking the import policy on the service connection is crucial to resolve the missing route.

Why this answer

The remote network is advertising the subnet, but the service connection's routing table lacks the route. This indicates that the service connection is receiving the advertisement but not installing it, which points to a BGP import policy filtering the route. The administrator should inspect the import policy on the service connection to ensure the route is permitted.

Exam trap

The trap here is assuming that if the remote network advertises the route, it will automatically be installed, ignoring the possibility of import filters on the receiving side.

Practice this question →
67
Multi-Selecthard

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Select 3 answers
A.Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.
B.Confirm that the CPE is actively advertising the correct IP prefixes to the Prisma Access BGP peer.
C.Verify the WildFire cloud analysis subscription status.
D.Verify that the BGP peer IP addresses configured on Prisma Access match the CPE peer addresses.
E.Check the GlobalProtect portal SSL certificate expiration date.
AnswersA, B, D

BGP peering requires matching or correctly mapped Autonomous System numbers between Prisma Access and the customer CPE. Mismatched AS configuration causes the session to fail or routes to be rejected, directly explaining why the CPE prefixes are never learned.

Why this answer

Option A is correct because BGP peering requires the AS numbers to be properly configured: for eBGP the local and remote AS must differ and match each side's configured peer AS, while for iBGP both peers must use the same AS, so a mismatch prevents the session from establishing and routes from being learned. Option B is correct because even with an established session, Prisma Access will not learn any prefixes unless the CPE actually advertises them via BGP network or redistribute statements, so confirming the advertised prefixes is essential. Option D is correct because the BGP peer IP configured on Prisma Access must exactly match the CPE's BGP source/peer address (and vice versa) for the TCP session on port 179 to form; a mismatch means no peering and no route exchange.

Option C is not relevant because WildFire cloud analysis is a threat-detection subscription and has no bearing on BGP route learning. Option E is not relevant because GlobalProtect portal SSL certificate expiration affects remote-user VPN authentication, not Remote Network BGP peering.

Practice this question →
68
MCQhard

A Prisma Access administrator is troubleshooting a mobile user who cannot access an internal application after a successful GlobalProtect connection. The administrator suspects that the issue is related to the split tunnel configuration. Which action should the administrator take to verify whether the application's subnet is included in the split tunnel?

A.Run a traceroute from the user's endpoint to the internal application.
B.Check the HIP profile match for the user in Prisma Access.
C.Check the GlobalProtect app logs on the user's endpoint for tunnel routes.
D.Review the Prisma Access system logs for split tunnel errors.
AnswerC

The GlobalProtect app logs on the endpoint contain information about the routes that are added to the client's routing table based on the split tunnel configuration. By examining these logs, the administrator can see exactly which subnets are included or excluded, confirming whether the internal application's subnet is correctly routed through the tunnel. This is the most direct method to verify the effective split tunnel behavior on that specific user's device.

Why this answer

Split tunnel configuration in GlobalProtect determines which traffic is routed through the VPN tunnel and which goes directly to the internet. When a user cannot reach an internal application, it is often because the application's subnet is not included in the split tunnel access routes. The most reliable way to verify this is to inspect the GlobalProtect app logs on the endpoint, which record the routes added to the routing table.

This confirms whether the subnet is correctly tunneled.

Exam trap

The trap here is assuming that server-side logs or HIP profiles would show split tunnel routes, when the actual route enforcement happens on the client and is logged locally.

Practice this question →
69
MCQeasy

A Prisma Access administrator is troubleshooting why a mobile user's traffic is not being inspected for threats. The administrator suspects that the security policy rule is not applying the correct security profiles. Which Prisma Access component should the administrator examine to confirm that the security profiles are attached to the rule?

A.The GlobalProtect portal configuration.
B.The service connection configuration.
C.The security policy rule in the Prisma Access policy configuration.
D.The decryption policy rules.
AnswerC

Security profiles are attached to security policy rules in the Prisma Access policy configuration. To verify that threat inspection is applied, the administrator must check the specific rule that matches the user's traffic and confirm that the appropriate security profiles (e.g., Antivirus, Anti-Spyware) are selected. Without profiles attached, traffic is allowed but not inspected. This is the direct place to validate profile attachment.

Why this answer

Security profiles are applied through security policy rules. To ensure threat inspection, the administrator must verify that the rule matching the user's traffic has the correct profiles attached. The GlobalProtect portal, decryption policy, and service connection are not where profiles are configured.

Checking the security policy rule directly confirms whether inspection is enabled for that traffic.

Exam trap

The trap here is assuming that decryption or portal settings automatically enable threat inspection, when in fact security profiles must be explicitly attached to a security policy rule.

Practice this question →
70
MCQeasy

An administrator needs to verify the license status and active subscriptions (such as WildFire, Threat Prevention, and URL Filtering) for Prisma Access in Panorama. Which menu path should be used?

A.Monitor > Logs > System.
B.Objects > Applications.
C.Panorama > Cloud Services > Setup > Licenses or Panorama > License.
D.Policies > NAT.
AnswerC

Panorama's Cloud Services licence view exposes Prisma Access subscription entitlements, including WildFire, Threat Prevention and URL Filtering, so an administrator can confirm which services are active against the tenant. This satisfies the stem's requirement to verify licence status and active subscriptions directly from Panorama.

Why this answer

In Panorama managing Prisma Access, license and subscription information — including WildFire, Threat Prevention, URL Filtering, and other Prisma Access subscriptions — is viewed under Panorama > Cloud Services > Setup > Licenses, or alternatively under Panorama > License depending on the Panorama version and deployment. This is where administrators verify active subscriptions and license status for the Prisma Access tenant.

Exam trap

SSE-Engineer often tests the confusion between Panorama license menus for traditional firewalls versus Prisma Access cloud service licenses — candidates may select a log or policy menu instead of the Cloud Services license path.

How to eliminate wrong answers

Option A is wrong because Monitor > Logs > System displays system event logs (e.g., configuration commits, HA events, process restarts), not license or subscription information. Option B is wrong because Objects > Applications is where custom application definitions and application filters are managed, not licenses. Option D is wrong because Policies > NAT is where NAT policy rules are configured, which is unrelated to license verification.

Practice this question →
71
MCQhard

A Prisma Access administrator is troubleshooting an issue where remote network users experience slow throughput to a specific SaaS application. The administrator suspects that the traffic is not being optimized by the Prisma Access cloud. Which feature should the administrator verify is enabled to ensure optimal routing?

A.Ensure that the SaaS application is included in an Application Override policy.
B.Confirm that the SaaS application is recognized and that the appropriate Service Connection is selected for optimal egress.
C.Check that the IPsec tunnel to the remote network is using IKEv2 with AES-256 encryption.
D.Verify that the 'Optimize Traffic' setting is enabled in the Service Connection configuration.
AnswerB

Prisma Access uses application identification to determine the best Service Connection for SaaS traffic. If the application is recognized, Prisma Access can route it to the nearest or most optimal Service Connection, reducing latency. If it is not recognized, traffic may take a suboptimal path. Verifying that the application is correctly identified and that the Service Connection selection is optimal is key to ensuring performance.

Why this answer

Prisma Access uses application identification to classify SaaS traffic and then selects the optimal Service Connection based on factors like proximity and health. If the application is not recognized, it may be routed through a default Service Connection that is not optimal. Ensuring the application is recognized and that the Service Connection selection is correct is essential for optimal performance.

Exam trap

The trap here is assuming that encryption settings or application override policies directly control cloud optimization, when the key is application identification and dynamic Service Connection selection.

Practice this question →
72
MCQhard

An enterprise user reports that when connected to Prisma Access Mobile Users, certain internal applications load extremely slowly or fail to render images. Investigation reveals that packet fragmentation is occurring. Which Prisma Access setting should the administrator adjust to mitigate this fragmentation issue for mobile users?

A.Change the mobile user IP pool subnet mask from /24 to /16.
B.Disable WildFire file forwarding for large files.
C.Increase the decryption profile timeout value.
D.Configure TCP MSS adjustment on the GlobalProtect tunnel settings or reduce the tunnel interface MTU.
AnswerD

Lowering the tunnel interface MTU or clamping TCP MSS prevents oversized packets from being fragmented across the GlobalProtect tunnel, satisfying the requirement to mitigate fragmentation for mobile users. This keeps encapsulated packets within path MTU limits.

Why this answer

TCP MSS adjustment (or lowering the tunnel interface MTU) is the correct fix because fragmentation on the GlobalProtect/Prisma Access tunnel occurs when the encapsulated packet exceeds the path MTU. By clamping TCP MSS on the tunnel or reducing the tunnel MTU, the endpoint negotiates a smaller segment size so packets fit inside the tunnel without fragmenting. This directly addresses the root cause of slow/failed rendering for mobile users.

Exam trap

SSE-Engineer often tests whether candidates confuse application-layer tuning (WildFire, decryption timeouts) with the actual Layer 3/4 cause of fragmentation, which is always MTU/MSS related.

How to eliminate wrong answers

Option A is wrong because changing the mobile user IP pool from /24 to /16 only alters address space and has no effect on packet size or MTU. Option B is wrong because WildFire file forwarding is a security inspection feature and disabling it does not change packet encapsulation or MTU behavior. Option C is wrong because decryption profile timeouts govern session handling for decrypted traffic, not packet fragmentation.

Practice this question →
73
Multi-Selectmedium

A Prisma Access administrator is troubleshooting a mobile user who cannot access a specific internal web application. The application is reachable from other mobile users, and the user's GlobalProtect connection is established. The administrator wants to verify whether the user's traffic is being decrypted and inspected by the security policy. Which TWO actions should the administrator take to confirm that SSL decryption is applied to the user's session? (Choose two.)

Select 2 answers
A.Review the decryption logs to see if the session appears
B.Check the traffic logs for the session and verify the 'Decrypted' flag
C.Check the system logs for decryption-related events
D.Examine the GlobalProtect app logs on the user's endpoint for SSL errors
E.Use the Prisma Access CLI to run 'show session all' for the user
AnswersA, B

Decryption logs specifically record sessions that were decrypted and the policy that matched. If the user's session appears in the decryption logs, it confirms that SSL decryption was applied. Absence from these logs indicates the traffic was not decrypted, which can explain why a security policy did not block or inspect it.

Why this answer

To confirm SSL decryption is applied to a specific session, the administrator should check both traffic logs and decryption logs. The traffic log's 'Decrypted' flag indicates whether the session was decrypted, while decryption logs provide detailed records of decrypted sessions, including the policy matched. Together, they verify that decryption occurred and can help identify why a security policy may not have blocked the traffic.

Exam trap

The trap here is assuming that the absence of SSL errors on the endpoint or the presence of system logs proves decryption occurred, when only traffic and decryption logs provide definitive per-session evidence.

Practice this question →
74
MCQmedium

A Prisma Access mobile user connects successfully via GlobalProtect but cannot reach any internal applications hosted behind a Service Connection. The administrator confirms the Service Connection status is green and the user's HIP profile is compliant. Which log source should the administrator check first to verify that the user's traffic is being routed through the expected Service Connection?

A.GlobalProtect App logs on the endpoint
B.Traffic logs filtered by the user and destination
C.HIP match logs in the Prisma Access gateway
D.System logs on the Prisma Access portal
AnswerB

Traffic logs in Prisma Access record the session details including the source user, destination IP, and the egress interface or Service Connection used. Filtering by the mobile user and the internal application destination reveals whether the traffic is being routed via the Service Connection or dropped, directly answering the question.

Why this answer

Traffic logs are the authoritative source for verifying session-level routing in Prisma Access. They include fields such as source user, destination, and the Service Connection or egress interface used. By filtering on the mobile user and the internal application IP, the administrator can see whether the traffic is being sent through the expected Service Connection or being dropped, which directly diagnoses the issue.

Exam trap

The trap here is assuming that a green Service Connection status and a compliant HIP profile guarantee that user traffic is using that Service Connection, when the actual forwarding decision must be verified in traffic logs.

Practice this question →
75
MCQhard

An administrator is troubleshooting a Prisma Access mobile user who reports that DNS resolution for internal domains fails intermittently. The user is connected via GlobalProtect, and the internal DNS servers are reachable. The administrator suspects that DNS queries are being sent to the wrong DNS server due to split-tunnel configuration. Which log source should the administrator check to see which DNS server the client is using for internal queries?

A.System logs on the Prisma Access portal
B.GlobalProtect app logs on the endpoint
C.HIP match logs in the Prisma Access gateway
D.Traffic logs filtered by DNS application
AnswerB

GlobalProtect app logs on the endpoint record the DNS server settings pushed by the gateway, including the DNS servers for the tunnel and any split-DNS configuration. They can show which DNS server the client is using for specific domains, helping to diagnose intermittent resolution failures due to misconfigured split-tunnel or split-DNS settings.

Why this answer

GlobalProtect app logs on the endpoint are the best source to verify which DNS servers the client is using. They record the DNS settings received from the gateway, including split-DNS domains and the corresponding DNS servers. By examining these logs, the administrator can confirm whether internal domains are being resolved by the correct internal DNS server or if they are incorrectly sent to an external DNS server.

Exam trap

The trap here is assuming that traffic logs will show the DNS server IP for a query, when in fact client-side DNS server assignment is best verified in the GlobalProtect app logs on the endpoint.

Practice this question →
Page 1 of 2 · 98 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Prisma Access Troubleshooting questions.

Start 20-question session