scenario questions

An administrator wants to ensure that mobile users comply with security posture policies before accessing corporate applications. Which TWO elements are required to enforce HIP (Host Information Profile) checking? (Choose two)

An administrator is troubleshooting a Prisma Access deployment where mobile users in the London region report intermittent inability to reach internal applications published through a Service Connection. The administrator suspects that the Service Connection is not advertising the correct routes to the Remote Network SPN. Which TWO items should the administrator verify on the Service Connection configuration? (Choose two.)

A security engineer is deploying Prisma Access for mobile users and needs to ensure that all traffic from the GlobalProtect app is inspected by the security processing nodes, including traffic destined for the internet. Which setting must be configured in the Prisma Access mobile user configuration?

An enterprise deployment of Prisma Access uses explicit proxy. Users report that authentication prompts appear repeatedly when browsing internal web applications. What is the most likely cause of this authentication looping in an explicit proxy setup?

An administrator is configuring Prisma Access for Secure Web Gateway (SWG) and needs to ensure that SSL decryption is applied to traffic from mobile users. Which component must be configured to enable SSL decryption in Prisma Access?

A network architect is designing a Prisma Access deployment for a company with multiple remote networks. The company requires that traffic from remote networks to the internet be inspected by Prisma Access, but they also want to minimize latency for cloud applications. Which feature should be enabled to optimize routing for cloud applications?

An administrator is planning a Prisma Access deployment for a small company with 10 remote users. The company does not have any data centers or branch offices. The administrator wants to ensure that the remote users are protected by Prisma Access security policies. What is the minimum configuration required?

A Prisma Access administrator is troubleshooting a remote network where users experience slow throughput over the IPsec tunnel. The administrator suspects that the issue is related to the IPsec configuration or the underlying network. Which two actions should the administrator take to identify the cause? (Choose two.)

An administrator is configuring Prisma Access to provide secure web gateway services for mobile users. The requirement is to decrypt outbound SSL traffic for inspection, but only for categories that are not in a predefined exemption list. Where should the administrator configure the SSL decryption policy in Prisma Access?

An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?

A remote user reports that their GlobalProtect connection connects successfully to Prisma Access, but they cannot resolve internal fully qualified domain names (FQDNs). Where should the administrator check to ensure DNS server IP addresses are correctly pushed to the GlobalProtect client?

An administrator is troubleshooting a Prisma Access issue where mobile users are unable to access a newly deployed internal web application. The application is hosted in the data center and is reachable from the service connection. Security policy allows the traffic. Which log source should the administrator check first to determine whether the traffic is reaching the service connection?

A help desk technician reports that a Prisma Access mobile user cannot reach any resources, and the GlobalProtect client displays 'Portal unreachable' before the user even authenticates. The administrator confirms the user's internet connectivity is fine and other users at the same site are connected successfully. Which troubleshooting step should the administrator perform first?

An administrator is troubleshooting a Prisma Access deployment experiencing intermittent packet drops and high latency across remote branches. Which THREE diagnostic steps or tools should be used? (Choose three)

Which TWO of the following are prerequisites for setting up Cloud Identity Engine (CIE) with Prisma Access?

An administrator is reviewing the Prisma Access deployment and notices that a Remote Network site has been offline for several hours. The administrator wants to quickly identify whether the issue is related to the IPsec tunnel or to the underlying ISP connectivity. Which Prisma Access dashboard should the administrator use to view the tunnel status and related alerts?

Which administrative role or tool is primarily used to monitor the status, health, and aggregate traffic statistics of a Prisma Access deployment across all regions?

An enterprise requires mobile users connecting via Prisma Access to authenticate using an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is this authentication profile referenced in Panorama for mobile users?

Which TWO actions should an administrator take when troubleshooting high CPU utilization on Prisma Access cloud infrastructure nodes? (Choose two)

An enterprise is implementing Prisma Access and wants to ensure strict security governance. Which THREE capabilities are provided natively by Prisma Access security processing nodes (SPNs)? (Choose three)

An administrator notices that certain mobile users connecting via Prisma Access are experiencing intermittent authentication timeouts when authenticating via SAML 2.0. Where should the administrator check to verify the Identity Provider (IdP) connectivity status and SAML assertion errors within Panorama?

A Prisma Access administrator needs to publish an internal web application to Mobile Users through a Private Application. The application uses a hostname that is not resolvable by public DNS. The administrator wants Mobile Users' browsers to reach the app using its internal FQDN without exposing the app to the internet. What must be configured to achieve this?

An administrator is investigating a security alert in Prisma Access triggered by an Anti-Spyware profile. Which log contains the detailed packet capture (pcap) or attack details for this specific event?

An administrator needs to verify whether a Prisma Access Remote Network is successfully exchanging routes with the customer CPE router over BGP. Where can the real-time BGP peer state be checked?

An architect is designing a high-availability Remote Network location for Prisma Access. Which TWO methods can be used to ensure redundancy for branch office traffic connecting to Prisma Access? (Choose two)

You are troubleshooting a Mobile User connectivity issue where users cannot access internal resources. The Cloud Identity Engine (CIE) shows the user as authenticated, but the Security Policy log shows the traffic is dropped with 'policy-deny'. What is the most likely cause?

An administrator has deployed Prisma Access with a single Service Connection to an on-premises data center. Branch users at a Remote Network site report intermittent access to internal applications, while internet-bound traffic works reliably. The administrator suspects the Service Connection is the cause. Which action should the administrator take to confirm whether the Service Connection is the source of the problem?

An administrator is troubleshooting a Prisma Access deployment where mobile users report slow performance when accessing SaaS applications. The administrator suspects that traffic is being backhauled through a service connection instead of going directly to the internet. Which Prisma Access feature should the administrator verify to ensure that traffic is taking the optimal path?

An administrator is deploying Prisma Access with a service connection so that branch users can reach internal applications hosted in a data center. The branch traffic is tunneled to a Prisma Access mobile user location, and the administrator wants to confirm which component forwards traffic from the Prisma Access infrastructure to the data center. Which component provides this forwarding?

An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?

An administrator wants to check the status of active IPsec tunnels for a Prisma Access Remote Network location. Which Panorama menu path provides the most direct overview of IPsec tunnel health?

A security administrator at a company using Prisma Access needs to ensure that only corporate-managed Windows devices running Windows 10 version 21H2 or later can access internal applications. The administrator has already configured a HIP profile that checks the OS version and a HIP object for the OS. Which additional component must be configured to enforce this requirement?

An administrator is troubleshooting a Prisma Access deployment where mobile users are unable to access certain SaaS applications. The users are connected via GlobalProtect, and the administrator has confirmed that the GlobalProtect tunnel is up. The administrator suspects that the issue is related to SSL decryption. Which action should the administrator take to verify that SSL decryption is functioning correctly?

An SSE engineer is investigating why a Prisma Access mobile user's traffic to a SaaS application is being inspected by a decryption policy that should be bypassed. The decryption policy has a source user group that should exclude this user, and the user is a member of a different group. The engineer confirms the user's group membership in the identity provider is correct. Which factor is most likely causing the decryption policy to match unexpectedly?

A security engineer needs to ensure that DNS queries from Prisma Access mobile users are resolved by Prisma Access's built-in DNS proxy rather than by external DNS servers. Which configuration should the engineer perform?

An enterprise network team is troubleshooting a Prisma Access Remote Network deployment where DNS queries from branch offices are failing to resolve internal resources. Which THREE components should be inspected? (Choose three)

An administrator needs to ensure that mobile users connecting via Prisma Access resolve internal domain names using the corporate DNS servers rather than public resolvers. Where is this configured?

Which TWO tools or logs in Panorama should an administrator use when troubleshooting a security policy rule that is unexpectedly dropping legitimate user traffic in Prisma Access? (Choose two)

An engineer is configuring Prisma Access for a remote network location that uses an IPSec tunnel to connect to the Prisma Access infrastructure. The engineer needs to ensure that the tunnel is highly available and can fail over to a secondary ISP if the primary ISP fails. Which two actions should the engineer take to achieve this? (Choose two.)

An administrator is configuring Remote Networks in Prisma Access for a branch office using Internet Key Exchange Version 2 (IKEv2). During the configuration in Panorama, which component must be deployed on the branch office router to ensure proper IPsec tunnel establishment with the Prisma Access Service Connections and Remote Networks nodes?

An administrator wants to verify that threat prevention signatures are actively blocking simulated malicious traffic in a Prisma Access environment. Which testing tool or procedure is standard for verifying threat signatures safely?

Which Prisma Access feature enables enterprises to inspect and secure traffic between different virtual networks or cloud environments connected to the cloud service?

An administrator is configuring Prisma Access to enforce security policies for mobile users based on the user's department. The administrator wants to ensure that only members of the 'Finance' department can access a sensitive internal application. Which Prisma Access feature should the administrator use to dynamically assign users to a policy group based on their department attribute from the identity provider?

An organization is migrating their branch offices to Prisma Access Firewall as a Service (FWaaS). What is the primary method used to connect a physical branch office location to the Prisma Access cloud infrastructure securely?

When configuring Prisma Access via Panorama, which administrative role or permission is required to push configuration changes to the cloud infrastructure?

A security engineer is troubleshooting a Prisma Access deployment where mobile users report that traffic to a specific SaaS application is being inspected but the CASB inline policy is not applying the expected data-loss prevention action. The engineer confirms the SaaS application is identified in the traffic logs. Which log or dashboard should the engineer examine to determine whether the CASB policy matched and what action was taken?

An administrator is deploying a new Prisma Access tenant with a single service connection to an on-premises data center. The security team requires that all traffic from remote network branch offices to the data center be inspected by Prisma Access security policy before reaching internal applications. The administrator configures the remote network and service connection, but branch users report they can reach internal applications directly without any security inspection. What is the most likely cause?

A Prisma Access administrator needs to verify that the GlobalProtect portal is presenting the correct certificate to mobile users during authentication. Which tool should the administrator use to inspect the certificate presented by the portal?

An administrator wants to inspect outbound web traffic from mobile users for malware and spyware using Prisma Access. Which security profile type must be attached to the Security policy rule?

A security engineer is deploying Prisma Access for a remote network that connects via a single IPsec tunnel to a service connection. The organization wants to provide redundancy in case the primary tunnel fails. The remote network has two ISP links with static public IP addresses. Which configuration should the engineer use to achieve tunnel redundancy?

An administrator is troubleshooting a Prisma Access mobile users deployment where some users cannot access a critical internal web application. The application is hosted in a remote network that is connected to Prisma Access via a service connection. Other users in the same region can access the application successfully. The affected users are able to access other internal resources. What is the most likely cause?

An administrator is troubleshooting a Prisma Access remote network where IPsec tunnel status shows up, but traffic from the branch is intermittently dropped when it exceeds a certain throughput. The branch has a single ISP link with 500 Mbps capacity and the tunnel is configured with default settings. Which cause should the administrator investigate first?

An administrator notices that a subset of mobile users connecting via GlobalProtect in Prisma Access cannot resolve internal corporate hostnames, while external websites load normally. The split-tunnel configuration includes the corporate domain. Where should the administrator check first in Panorama to troubleshoot this DNS resolution failure?

An administrator needs to verify that a newly configured remote network in Prisma Access is operational and passing traffic. Which status indicator in the Prisma Access dashboard should the administrator check first to confirm the IPSec tunnel is established?

An administrator has just finished configuring a new Prisma Access tenant and wants to verify that Mobile Users can connect and that security policy is being applied. The administrator needs a high-level view of connected Mobile Users, their locations, and the applications in use. Which Prisma Access monitoring area should the administrator use?

When planning a Prisma Access deployment for Mobile Users, which IP address allocation method is recommended and most commonly used for assigning virtual IP addresses to GlobalProtect clients?

An architect is designing a Prisma Access deployment for a company with offices in North America and Europe. The company wants to minimize latency for users accessing SaaS applications. Which Prisma Access feature should be leveraged to achieve this?

An administrator configuring Prisma Access ZTNA wants to view real-time metrics regarding active mobile user connections, bandwidth consumption per region, and tunnel status. Which tool provides this specific operational dashboard?

Which THREE factors influence the selection of a Compute Location in a Prisma Access deployment?

An administrator is designing a Prisma Access Secure Web Gateway (SWG) and CASB architecture. Which THREE capabilities can be enforced natively through Prisma Access SWG and inline CASB policies? (Choose three)

A Prisma Access administrator notices that a mobile user's traffic to a sanctioned SaaS application is being routed through a Service Connection in a different region than expected, causing high latency. The administrator wants to verify which Service Connection the user's session is currently using for that application. Which action should the administrator take?

An administrator is planning to deploy Prisma Access for a company with a single data center and multiple branch offices. The administrator needs to ensure that branch office traffic to the internet is secured by Prisma Access, while traffic to the data center is routed directly. Which Prisma Access component must be deployed to connect the branch offices to Prisma Access?

An administrator is troubleshooting connectivity issues for a remote network connected to Prisma Access via IPsec VPN. Which TWO checks should be performed to verify tunnel health and status? (Choose two)

Which Prisma Access service capability provides secure, least-privilege remote access for third-party contractors who cannot install the GlobalProtect agent on their managed or unmanaged devices?

An administrator needs to verify whether Host Information Profile (HIP) checks are failing for a specific mobile user attempting to connect to Prisma Access. Which log should the administrator review in Panorama?

An administrator wants to view historical bandwidth utilization trends for a specific Remote Network location over the past 30 days. Which Panorama monitoring workspace provides this historical reporting?

An administrator is troubleshooting a Prisma Access mobile user who reports that corporate applications are unreachable, yet public websites load normally. In the Prisma Access status dashboard, the user's GlobalProtect connection shows Connected and the tunnel is assigned a 10.201.x.x address, but the Service Connection to the corporate data center shows a status of Down. Which action should the administrator take to resolve the user's issue?

A Prisma Access administrator is troubleshooting a Remote Network deployment where branch users cannot reach internal applications hosted in a data center connected via an IPsec tunnel. The administrator confirms that the Remote Network IPsec tunnel is up and that the branch firewall routes the internal subnets toward Prisma Access. Which action should the administrator take next to verify that Prisma Access is correctly routing traffic to the data center?

An administrator has deployed Prisma Access Remote Networks, but traffic from a branch office is failing to pass through the IPsec tunnel to Prisma Access. The IKE phase 1 negotiation is failing. Which Prisma Access operational command should the administrator run via the CLI to check the IPsec tunnel status and IKE SA parameters?

An administrator notices that Prisma Access mobile users in the EMEA region are being assigned IP addresses from the 10.20.0.0/16 pool, which overlaps with an internal subnet at 10.20.10.0/24 that users must reach. What should the administrator do in the Prisma Access mobile user configuration to avoid the conflict?

An architect is planning a Prisma Access deployment for a multinational company with offices in North America, Europe, and Asia. The company requires that all internet-bound traffic from branch offices be inspected by Prisma Access, and that traffic to internal applications be routed through a Service Connection to a data center in Europe. The architect must minimize latency for internet-bound traffic while ensuring that internal traffic goes through the data center. Which design should the architect use?

You are deploying Prisma Access and need to ensure that traffic from mobile users accessing the internet is inspected by a specific set of security profiles. Where should these profiles be applied?

An organization is migrating its identity provider integration to the Cloud Identity Engine (CIE) to support Prisma Access authentication and User-ID. When configuring the connection between CIE and the enterprise Active Directory, which component is required on-premises to sync directory objects securely without opening inbound firewall ports?

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

An administrator has configured Prisma Access to forward logs to an external SIEM using a HTTPS log forwarding profile. After a week, the SIEM shows no Prisma Access logs, but the Prisma Access dashboard shows traffic and threats. Which item should the administrator verify first?

An administrator is configuring authentication for Prisma Access mobile users. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

An enterprise is deploying Prisma Access Service Connections to connect corporate data centers to the cloud security platform. Which THREE configuration parameters must be correctly specified on Panorama for a Service Connection? (Choose three)

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

Which TWO actions should an administrator take to troubleshoot an authentication failure when mobile users attempt to log into Prisma Access using SAML? (Choose two)

A Prisma Access deployment has multiple Remote Networks and Mobile Users. An administrator implements Quality of Service (QoS) to prioritize VoIP traffic over bulk file transfers. After applying the QoS profile, VoIP performance does not improve. What should the administrator verify first in the Prisma Access QoS configuration?

A security administrator needs to quickly identify which users are consuming the most bandwidth through Prisma Access mobile user connections over the past 24 hours. Which Prisma Access monitoring dashboard or report should the administrator use?

An administrator is deploying Prisma Access for a new remote network site. The site requires access to both the internet and internal applications hosted in an on-premises data center. The administrator has configured a service connection to the data center. Which additional configuration is required to allow remote network users to access internal applications?

An administrator is troubleshooting a Prisma Access deployment where mobile users are intermittently disconnected when moving between trusted Wi-Fi networks and cellular connections. Which GlobalProtect client setting in Prisma Access helps maintain session persistence and fast reconnection during network roaming?

An administrator is configuring Prisma Access to provide secure access to private applications for mobile users using ZTNA 2.0. The administrator must ensure that the solution enforces least-privilege access and continuous trust verification. Which TWO configurations are required to meet these requirements? (Choose two.)

An engineer is designing a Prisma Access deployment for a company that requires that all traffic from remote users be inspected by the same security policy stack regardless of the user's location. The company has offices in North America, Europe, and Asia. The engineer must ensure that the security policy is enforced consistently and that users always connect to the closest Prisma Access compute location. Which configuration should the engineer use to achieve this?

Which object type should be used to restrict access to a specific internal application for Remote Network users while ensuring the policy is scalable?

A security engineer is troubleshooting why a Prisma Access mobile user's traffic to a specific external website is being allowed despite a security policy rule that should block it. The rule is configured with a source user of 'domain\jdoe' and a destination of 'any', and the action is deny. The user is authenticated via GlobalProtect with User-ID enabled. What is the most likely reason the rule is not matching?

When troubleshooting a Prisma Access deployment using SAML authentication, an administrator notices that users are successfully authenticated by the IdP, but the GlobalProtect client displays an error stating 'Invalid SAML Response: Signature Validation Failed'. What is the most likely root cause?

An administrator is reviewing the Prisma Access license and notices that the organization has purchased the Prisma Access for Networks license but not the Prisma Access for Users license. Which functionality is available with this license?

An administrator is reviewing the status of Remote Networks in Prisma Access and notices that an IPsec tunnel has failed to establish. Which THREE diagnostic steps or verifications should the administrator perform in Panorama or Prisma Access Insights? (Choose three)

When configuring a Remote Network (RN) connection to an on-premises data center, which parameter is required to ensure proper routing of internal traffic via the IPSec tunnel?

A Prisma Access administrator is troubleshooting a mobile user who reports that after connecting via GlobalProtect, they cannot access internal web servers by hostname, but can access them by IP address. Other mobile users in the same region do not have this issue. Which component should the administrator verify first?

An administrator is onboarding a new remote network in Prisma Access and wants to verify that the tunnel is healthy after configuration. Which two status indicators should the administrator check in the Prisma Access status view to confirm the remote network tunnel is up? (Choose two.)

An enterprise network administrator is troubleshooting an IPsec tunnel failure between a remote network and Prisma Access where Dead Peer Detection (DPD) keeps tearing down the tunnel. Which THREE potential causes should be investigated? (Choose three)

An administrator is configuring Prisma Access Remote Networks to connect branch offices to the cloud security backbone. Which TWO configuration steps are required on Panorama to establish a functional Remote Network connection? (Choose two)

An administrator has deployed Prisma Access for a branch office remote network that must reach a SaaS application through a service connection. After committing the configuration, users report that traffic is being dropped at the remote network firewall with the message 'no matching service connection found.' The administrator verifies that the service connection is up and the SaaS application is in the correct region. What is the most likely cause?

An administrator is setting up Prisma Access and needs to ensure that mobile users connecting from managed corporate laptops can access internal resources, while unmanaged contractor laptops are restricted to web-based applications only. Which Prisma Access mechanism distinguishes between managed and unmanaged endpoints during connection?

An administrator needs to verify the exact version of Prisma Access running on the cloud infrastructure. Where in Panorama is this version information displayed?

An administrator is configuring security policies in Prisma Access and wants to ensure comprehensive protection against unknown threats and malware. Which TWO security profile types should be applied to outbound and internet-bound rules? (Choose two)

When configuring Security policy rules in Prisma Access, which THREE types of criteria can be used to control traffic traversing the cloud infrastructure? (Choose three)

An administrator needs to give the security team a single dashboard that shows which Prisma Access security policy rules are being triggered most frequently across all mobile users and Remote Networks over the last 30 days. Which Prisma Access reporting capability should the administrator use?

An administrator is configuring Prisma Access to secure outbound internet traffic for mobile users. The requirement is to inspect all traffic for threats and sensitive data, but the organization wants to avoid decrypting traffic to financial and healthcare websites due to privacy regulations. Which Prisma Access feature should be used to meet this requirement?

An administrator is configuring Prisma Access Secure Web Gateway and wants to restrict access to high-risk web categories. Which TWO options represent configurable actions within a Prisma Access URL Filtering profile? (Choose two)

Which TWO actions should an administrator perform when troubleshooting User-ID mapping failures for mobile users in Prisma Access? (Choose two)

A remote network connected via Prisma Access is experiencing packet drops due to Maximum Transmission Unit (MTU) size mismatches. Which troubleshooting technique or configuration should be verified to resolve IP packet fragmentation issues?

Which TWO logs should an administrator check in Panorama when troubleshooting a mobile user who reports that their connection keeps dropping after a short period of time? (Choose two)

A Prisma Access mobile user experiences a scenario where specific internal domains fail to resolve when connected via GlobalProtect, while other internal domains resolve successfully. The split-DNS configuration in Panorama lists multiple domains. What is the most likely reason for this partial DNS failure?

A Prisma Access administrator is investigating why a specific mobile user is unable to access a web application that is allowed by a security policy. The administrator suspects that the user is being blocked by a URL Filtering profile. Which log type should the administrator check first to confirm the block?

A security engineer is planning a Prisma Access deployment for a company with offices in North America and Europe. The company wants to ensure that users in each region connect to the nearest Prisma Access location to minimize latency. Which Prisma Access component should the engineer configure to achieve this?

An administrator has configured a Service Connection in Prisma Access with BGP to advertise internal routes. After a configuration change, internal users can no longer reach resources in a specific subnet. The administrator verifies that the BGP session is established and that the subnet is advertised from the on-premises router. Which action should the administrator take to ensure that Prisma Access accepts and uses the advertised route?

Which cloud infrastructure providers host the backend Security Processing Nodes (SPNs) used by Prisma Access?

What is the benefit of using Prisma Access for Remote Networks instead of traditional site-to-site VPNs?

An administrator is configuring Prisma Access to enforce security policy for Mobile Users. The administrator wants to ensure that traffic from Mobile Users is inspected for threats and that users are identified by their corporate credentials. Which TWO components must be configured to achieve this? (Choose two.)

An administrator is configuring Mobile Users in Prisma Access and needs to set up user authentication. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

An administrator implements a new Decryption policy in Prisma Access to inspect inbound traffic to a public-facing application hosted behind a Prisma Access Public IP. After deployment, users report receiving certificate warning errors. What should the administrator inspect first to resolve the warning?

A security architect is designing a Prisma Access FWaaS deployment and needs to ensure robust security posture across all zones (Mobile Users, Remote Networks, Service Connections, and Internet). Which THREE security profile types should be attached to Security Policy rules to ensure comprehensive threat prevention? (Choose three)

An administrator is deploying a new Prisma Access Remote Network location and needs to ensure that traffic from the branch is inspected by security policies before reaching the internet. Which configuration step is required to direct traffic to Prisma Access for inspection?

Which tool provides end-to-end visibility into Prisma Access performance, user experience metrics, and digital experience monitoring (DEM)?

A security engineer is deploying Prisma Access and needs to ensure that explicit proxy traffic from remote users is inspected. Which component must be configured in the Prisma Access infrastructure to handle explicit proxy traffic?

An administrator is configuring Prisma Access Firewall as a Service (FWaaS) to protect outbound internet traffic from remote networks. They want to ensure that known command-and-control (C2) traffic and vulnerability exploits are blocked dynamically in real time. Which security profile should be applied to the security policy rules?

An administrator is troubleshooting a Prisma Access issue where mobile users in a specific region experience intermittent connectivity drops. The administrator observes that the GlobalProtect agent logs show repeated gateway selection changes. Which action should the administrator take to stabilize the connection?

A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?

An engineer is planning the initial deployment of Prisma Access for an organization that wants to avoid routing internal traffic through the corporate data center for internet-bound traffic. Which deployment component must be configured to allow mobile users to connect directly to Prisma Access and access the internet without backhauling through headquarters?

An administrator is configuring Prisma Access for a branch office to provide secure internet access. They want to ensure that the branch users' traffic is inspected for threats and that access to risky URLs is blocked. Which two components are required in the Prisma Access configuration to achieve this? (Choose two.)

A security administrator is troubleshooting a Prisma Access mobile user who cannot access an internal application hosted in a branch office. The user is connected via GlobalProtect and can reach the internet. The administrator has verified that the user's security policy allows the traffic. Which step should the administrator take next to diagnose the issue?

A network architect is planning a Prisma Access deployment for a company with a large remote workforce. The company wants to ensure that remote users can access both internet and internal applications securely. The architect decides to use Prisma Access for both internet and private application access. Which component must be configured to allow remote users to access internal applications hosted in the corporate data center?

A security engineer manages a Prisma Access deployment with 5,000 mobile users. The organization wants to enforce different security policies for users in the Finance department versus the Engineering department, without deploying separate GlobalProtect portals or gateways. The identity provider is SAML-based and already integrated. What is the most operationally efficient way to achieve this?

A network administrator wants to enable User-ID for mobile users connecting via GlobalProtect in Prisma Access. Which component should be configured to map users to IP addresses when using the Cloud Identity Engine?

A security engineer is configuring Prisma Access to inspect traffic from remote networks to the internet. The engineer wants to ensure that all web traffic is inspected for threats and that certain high-risk web categories are blocked. Which TWO configurations are required to achieve this? (Choose two.)

A network engineer is configuring a new Remote Network in Prisma Access and needs to ensure that traffic from the branch office to the internet is breakout locally rather than backhauled to headquarters. How is local internet breakout verified in Prisma Access?

A Prisma Access deployment utilizes Service Connections to connect to a corporate data center. An administrator notices that traffic destined for internal data center subnets is being sent out to the internet instead of the Service Connection. What is the most likely cause of this routing misconfiguration?

A security engineer is configuring a Prisma Access Remote Network location with redundant IPsec tunnels to ensure high availability. What configuration requirement must be met on the customer premise equipment (CPE) router to support dynamic routing over these redundant tunnels?

A Prisma Access administrator is troubleshooting a Service Connection that repeatedly flaps, causing intermittent loss of access to internal applications for both mobile users and remote networks. The IPsec tunnel to the data center establishes but drops within minutes. Which TWO items should the administrator verify to isolate the cause? (Choose two.)

Which log category in Prisma Access records events when a user's host information profile (HIP) changes or fails a compliance check?

An administrator needs to configure Prisma Access ZTNA to verify endpoint hygiene before granting access to internal applications. Which TWO posture checks can be evaluated using GlobalProtect Host Information Profiles (HIP)? (Choose two)

Which TWO logs or monitoring views in Panorama are essential when troubleshooting a remote network user's inability to reach a specific cloud application via Prisma Access? (Choose two)

An administrator needs to review configuration changes made to Prisma Access settings in Panorama over the past week to determine who modified a security policy. Which log should the administrator examine?

An engineer is deploying Prisma Access for the first time and needs to onboard the infrastructure using the Prisma Access Cloud Management portal. The organization requires that all configuration changes be validated before being pushed to production. Which built-in workflow should the engineer use to meet this requirement?

A deployment of Prisma Access requires ZTNA 2.0 posture check enforcement for remote users. The administrator must ensure that mobile devices attempting to connect to internal corporate apps are evaluated for disk encryption and active endpoint protection agents prior to tunnel establishment. Which component performs this real-time device posture assessment?

An administrator needs to configure secure connectivity between a corporate data center and Prisma Access for headquarters-bound traffic. Which type of connection object should be created in Panorama?

An administrator needs to provide access to a set of internal web applications for mobile users connected through Prisma Access. The applications are hosted in an on-premises data center and must be reachable only by authenticated users, with traffic inspected for threats. Which Prisma Access component should the administrator configure to enable this access?

A security engineer is deploying Prisma Access with a service connection to an on-premises data center. The data center hosts a critical application at 10.10.10.50/32. The engineer wants all traffic from mobile users destined to that IP to be routed through the service connection and inspected by Prisma Access security policies, while all other internet-bound traffic goes directly to the internet. Which configuration should the engineer use?

A network engineer is troubleshooting why a specific security policy rule configured in Panorama is not matching traffic in a Prisma Access environment. Which Panorama testing tool simulates traffic against security rules to verify rule evaluation?

An architect is planning a Prisma Access deployment with a Service Connection to a data center. The data center advertises a default route (0.0.0.0/0) to Prisma Access over BGP. The architect wants to ensure that internet-bound traffic from Remote Networks is inspected by Prisma Access and not sent back to the data center. Which configuration should be applied to prevent the default route from being used for internet traffic?

Which TWO configuration steps should an administrator verify when troubleshooting an issue where Panorama cannot push updates or configurations to Prisma Access nodes? (Choose two)

A Prisma Access administrator needs to verify that a specific mobile user's traffic is being inspected by the correct security policy rule. The administrator wants to see the rule name that allowed or denied a recent session. Which log type should the administrator consult?

An architect is planning a Prisma Access deployment for a large enterprise with multiple Remote Network locations. The architect must ensure that the deployment meets the requirements for high availability and scalability. Which TWO factors should the architect consider when designing the Remote Network locations? (Choose two.)

An engineer is deploying a new Prisma Access tenant for a multinational company. The security team requires that all remote user traffic be inspected by a dedicated set of Security Processing Nodes located in the same region as the users, to minimize latency. The company has offices in North America, Europe, and Asia. Which deployment model should the engineer choose to meet this requirement?

An organization is deploying Prisma Access CASB and Secure Web Gateway features. Which THREE capabilities are provided by Prisma Access Inline CASB compared to out-of-band SaaS Security API? (Choose three)

A Prisma Access engineer is troubleshooting a Service Connection that is not establishing. The engineer suspects that the issue is related to the Service Connection configuration or network reachability. Which two actions should the engineer perform to validate the Service Connection status and connectivity? (Choose two.)

During the initial deployment of Prisma Access for remote networks, an administrator needs to define the bandwidth allocation for a specific compute location. Which tool is used to manage and push this bandwidth allocation?

An administrator is configuring a Service Connection in Prisma Access and wants to ensure that traffic from remote networks to on-premises resources is routed correctly. The on-premises network uses BGP with a private AS number. Which configuration must be applied on the Prisma Access side to establish BGP peering?

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

A Prisma Access administrator needs to implement ZTNA 2.0 continuous trust verification for mobile users accessing internal private applications. Which feature ensures that continuous validation of both user identity and device posture occurs throughout the session, rather than only at initial authentication?

A security administrator needs to check real-time threat logs for a specific Prisma Access mobile user who reports being blocked from accessing a malicious file. Which Panorama menu path provides the most direct access to these logs?

Which TWO troubleshooting methods are effective when verifying whether Host Information Profile (HIP) checks are operating correctly for Prisma Access mobile users? (Choose two)

A Prisma Access engineer is troubleshooting a mobile user who cannot access an internal application after successfully connecting via GlobalProtect. The engineer suspects that the issue is related to the split-tunnel configuration. Which TWO actions should the engineer take to verify that the correct routes are being pushed to the client? (Choose two.)

An administrator is configuring Prisma Access Secure Web Gateway and wants to ensure that newly registered malicious domains are blocked automatically without waiting for manual signature updates. Which Palo Alto Networks security service provides real-time IP and domain threat intelligence to Prisma Access?

When designing high availability and redundancy for Prisma Access Remote Networks, which THREE considerations or practices are essential? (Choose three)

An administrator notices that Remote Network (branch) traffic to SaaS applications is being backhauled through the corporate data center instead of breaking out locally at the Prisma Access node. The administrator wants branch traffic destined to trusted SaaS applications to egress directly from the Prisma Access service connection. Which Prisma Access capability should be used to accomplish this?

An administrator notices that users connecting via Prisma Access Remote Networks are unable to reach a specific internal application hosted in the corporate datacenter. The traffic is dropped by Prisma Access. Which tool in Panorama should the administrator use first to verify if the security policy is matching and blocking the traffic in real-time?

An administrator is troubleshooting ZTNA connectivity issues for mobile users connecting via Prisma Access. Which TWO tools or log types in Panorama should the administrator check to diagnose user authentication and tunnel establishment problems? (Choose two)

Which component in Prisma Access is responsible for performing decryption, content inspection, and threat prevention for mobile users?

An administrator is planning a Prisma Access deployment for a new branch office. The branch has a single ISP connection and requires high availability for Remote Network connectivity. Which Prisma Access feature should the administrator use to provide redundancy?

When designing Security and Inspection Policies for Prisma Access, an administrator needs to ensure optimal performance and security coverage. Which THREE best practices should the administrator follow when implementing Security Policy rules in Panorama for Prisma Access? (Choose three)

An administrator is configuring Prisma Access for remote users and needs to ensure that split tunneling is used for specific applications. Which Prisma Access component is responsible for enforcing split tunneling policies?

Users connected through a Prisma Access remote network report that traffic to a partner's public web application is being blocked, while the same application works from a mobile user tunnel. The administrator confirms a URL Filtering profile is applied to both the remote network and mobile user policies. Which log type and filter should the administrator use to determine why the remote network traffic is blocked?

When managing Security Policies in Prisma Access, which TWO components are essential to ensure that policies are correctly applied to traffic?

An administrator needs to monitor the volume of traffic passing through a specific Prisma Access Service Connection. Which monitoring tool in Panorama displays aggregated data on bandwidth usage, top applications, and top users?

An enterprise deployment of Prisma Access utilizes Kerberos authentication for mobile users. Users report frequent authentication prompt failures when connecting via GlobalProtect from external networks. What is the most likely root cause of Kerberos authentication failure in this scenario?

An administrator is configuring Prisma Access to provide secure access for mobile users. The requirement is to ensure that all traffic from mobile users is inspected by Prisma Access, including traffic to the internet and to private applications. Which TWO configurations are necessary to achieve this? (Choose two.)

An administrator is setting up the Cloud Identity Engine (CIE) to support user mapping and authentication for Prisma Access. Which THREE components or steps are required for a successful CIE deployment? (Choose three)

An administrator needs to give a security operations analyst read-only access to Prisma Access logs and reports without allowing any configuration changes. Which Prisma Access administrative role should the administrator assign in the identity provider or Panorama?

A network administrator is troubleshooting a Prisma Access remote network deployment where users at a branch office are experiencing slow access to cloud applications. The administrator has verified that the IPsec tunnel is up and that there is no packet loss on the tunnel. Which tool should the administrator use to monitor the performance and latency of the Service Connection?

An administrator needs to optimize mobile user traffic performance and reduce latency in Prisma Access. Which THREE features or configurations can be utilized to achieve this? (Choose three)

A Prisma Access administrator is troubleshooting a remote network site where IPsec tunnels are flapping. The administrator suspects that the tunnel monitoring settings are too aggressive. Which configuration parameter should be adjusted to reduce flapping?

An administrator troubleshooting a Prisma Access mobile user connectivity issue wants to verify whether the GlobalProtect gateway is actively responding to client connection requests. Where can this real-time session and gateway status be verified?

An administrator is configuring Prisma Access to provide secure internet access for mobile users. The organization requires that all traffic to known malicious domains be blocked, and that SSL decryption be performed for traffic to categories such as 'malware' and 'phishing' to inspect for threats. The administrator enables SSL decryption in the decryption policy for these categories. However, after testing, users can still access some known malicious sites without any block or decryption. What is the most likely reason?

A Prisma Access administrator is troubleshooting a mobile user who reports that they cannot access any internal resources after connecting via GlobalProtect. The administrator checks the GlobalProtect status and sees that the user is connected. Which log should the administrator review first to determine why the user's traffic is being blocked?

A network security administrator is configuring Prisma Access to provide secure web gateway services to mobile users. The requirement is that all web traffic from the mobile users must be inspected for threats and URL filtering, and the administrator wants the simplest deployment that does not require installing certificates on the endpoints. Which Prisma Access capability should the administrator enable?

An administrator is troubleshooting a Prisma Access environment where threat prevention profiles are failing to block known malicious file downloads. Which THREE settings or logs should the administrator investigate? (Choose three)

A security administrator is troubleshooting a URL Filtering policy in Prisma Access where users are able to access a category that should be blocked. Which tool in Panorama should the administrator use to test and verify which URL category a specific website falls under and which policy rule applies?

An administrator is troubleshooting a Prisma Access mobile user environment where users are unable to connect because of an invalid certificate error presented by the GlobalProtect Portal. Which configuration element in Panorama should be verified?

An administrator is setting up a new Prisma Access deployment and needs to ensure that the initial configuration is applied correctly. The administrator has already activated the Prisma Access license and is now in the Prisma Access configuration workflow. Which step must be completed first before configuring Remote Networks and Service Connections?

An administrator is troubleshooting a Prisma Access deployment where specific applications are identified as 'incomplete' or 'unknown-tcp' in the Traffic logs. Which THREE factors or troubleshooting steps should be evaluated? (Choose three)

An administrator has deployed Prisma Access with a single Remote Network SPN at a branch office in Frankfurt. Users complain that after a failover of the primary ISP link, all traffic to SaaS applications is being forced through the backup link even though the primary link is healthy again. The administrator wants Prisma Access to automatically restore the preferred path without manual intervention. Which feature should be configured?

Which TWO actions should an administrator take when troubleshooting an IPsec site-to-site tunnel failure between a customer CPE device and a Prisma Access Remote Network node? (Choose two)

A Prisma Access administrator is troubleshooting an issue where mobile users are unable to access a specific internal application after a recent change. The administrator suspects that the issue is related to the service connection's routing. The administrator runs 'show routing route' on the service connection and sees the route to the internal subnet is missing. The remote network's BGP configuration shows the subnet is being advertised. What is the most likely cause?

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

A Prisma Access administrator is troubleshooting a mobile user who cannot access an internal application after a successful GlobalProtect connection. The administrator suspects that the issue is related to the split tunnel configuration. Which action should the administrator take to verify whether the application's subnet is included in the split tunnel?

A Prisma Access administrator is troubleshooting why a mobile user's traffic is not being inspected for threats. The administrator suspects that the security policy rule is not applying the correct security profiles. Which Prisma Access component should the administrator examine to confirm that the security profiles are attached to the rule?

What is the primary function of the GlobalProtect Portal in a Prisma Access deployment?

An architect is sizing a Prisma Access Remote Network location that experiences heavy video streaming traffic. Which factor is most critical when determining the required bandwidth license for this location?

An administrator is configuring Prisma Access SWG and needs to implement granular control over file sharing and collaboration tools. Which TWO SaaS Security features can be configured in Prisma Access to achieve this? (Choose two)

An administrator is reviewing the operational health and logs of Prisma Access. Which TWO monitoring tools or log types are available within Panorama for troubleshooting security events and traffic flows? (Choose two)

A security engineer is configuring Prisma Access to provide secure access to private applications hosted in an on-premises data center for mobile users. The engineer has set up a service connection and configured the private applications. However, users are unable to reach the applications. The engineer suspects that the issue is related to the service connection configuration. Which TWO items should the engineer verify to ensure the service connection is correctly established? (Choose two.)

An administrator needs to verify the license status and active subscriptions (such as WildFire, Threat Prevention, and URL Filtering) for Prisma Access in Panorama. Which menu path should be used?

An organization requires traffic from remote users to specific SaaS applications to bypass the Prisma Access cloud security processing nodes and go directly to the internet. Which feature should the administrator configure?

An administrator is configuring Prisma Access for the first time and needs to onboard the Prisma Access infrastructure. Which step must be completed before configuring Remote Networks and Service Connections?

A Prisma Access administrator is troubleshooting an issue where remote network users experience slow throughput to a specific SaaS application. The administrator suspects that the traffic is not being optimized by the Prisma Access cloud. Which feature should the administrator verify is enabled to ensure optimal routing?

An administrator is deploying Prisma Access for a new Remote Network site that requires access to both the internet and internal applications. The administrator has already configured the Remote Network and Service Connection. Users report that internet access works, but internal application access fails. The administrator confirms that the Service Connection BGP session is established and advertising routes. Which configuration should the administrator verify next on the Remote Network?

An enterprise user reports that when connected to Prisma Access Mobile Users, certain internal applications load extremely slowly or fail to render images. Investigation reveals that packet fragmentation is occurring. Which Prisma Access setting should the administrator adjust to mitigate this fragmentation issue for mobile users?

A Prisma Access administrator is troubleshooting a mobile user who cannot access a specific internal web application. The application is reachable from other mobile users, and the user's GlobalProtect connection is established. The administrator wants to verify whether the user's traffic is being decrypted and inspected by the security policy. Which TWO actions should the administrator take to confirm that SSL decryption is applied to the user's session? (Choose two.)

A network engineer is configuring remote user access in Prisma Access and needs to ensure that internal corporate DNS resolution is utilized when users are connected via the GlobalProtect app. Where must the engineer configure the primary and secondary internal DNS server IP addresses?

A security engineer is configuring Prisma Access to inspect traffic from remote networks to the internet. They want to ensure that all web traffic is scanned for threats and that file downloads are restricted based on file type. Which Prisma Access service should they configure to achieve this?

An administrator is configuring a Remote Network in Prisma Access to connect a branch office. The branch office has a single ISP link and requires high availability. The administrator wants to ensure that if the primary IPSec tunnel fails, traffic automatically switches to a secondary tunnel. Which Prisma Access feature should be configured to achieve this?

An enterprise wants to ensure that all internet-bound traffic from mobile users is decrypted and inspected for malware and sensitive data using Prisma Access SWG. Which GlobalProtect client traffic forwarding configuration ensures that all traffic is sent to Prisma Access?

Which log type in Prisma Access should an administrator examine to review details about blocked URLs, category ratings, and user web-browsing attempts?

An administrator is configuring QoS in Prisma Access for a Remote Network connection. Where must the QoS profile be applied to ensure priority handling for VoIP traffic coming from the branch?

An administrator is configuring a Prisma Access Service Connection for a data center that hosts both production and development workloads. The security team requires that mobile users accessing development subnets be inspected by a different security policy than those accessing production subnets, without deploying separate Service Connections. Which approach should the administrator take?

An enterprise using Prisma Access Mobile Users needs to enforce Host Information Profile (HIP) checks to ensure that endpoints have an active and updated corporate antimalware solution before granting access to internal applications. Which workflow must an administrator complete to successfully enforce this requirement?

When designing a Prisma Access deployment for remote workers, which component authenticates the user and assigns the appropriate GlobalProtect gateway connection based on geographic location?

An administrator notices that certain SaaS applications are not being accurately identified or controlled by Prisma Access CASB inline policies due to domain fronting and complex URL structures. Which feature should the administrator configure in Prisma Access to ensure deep application identification and decryption of this traffic?

An organization is integrating Prisma Access with their existing Panorama deployment. Which plugin must be installed on Panorama to enable the Prisma Access configuration workflows?

A Prisma Access mobile user connects successfully via GlobalProtect but cannot reach any internal applications hosted behind a Service Connection. The administrator confirms the Service Connection status is green and the user's HIP profile is compliant. Which log source should the administrator check first to verify that the user's traffic is being routed through the expected Service Connection?

An administrator is deploying a new Prisma Access tenant for a company with branch offices in North America and Europe. The security team requires that all branch traffic egress through a Prisma Access location in the same region as the branch to minimize latency, while still allowing failover to another region during an outage. Which Prisma Access configuration should the administrator implement?

An enterprise is deploying Prisma Access and wants to ensure that user identity mapping is gathered efficiently from Microsoft Entra ID (formerly Azure AD) without deploying physical User-ID agents inside the cloud network. Which integration method should be used?

An administrator is troubleshooting a Prisma Access mobile user who cannot access any internal applications. The administrator has verified that the GlobalProtect app shows a connected status and that the user's authentication is successful. Which two actions should the administrator take to identify the cause? (Choose two.)

A security engineer is configuring Prisma Access to protect mobile users from malicious downloads. The requirement is that files downloaded from the internet by mobile users must be analyzed for zero-day malware, and the analysis must not delay the user's download. Which Prisma Access feature should the engineer configure?

An administrator needs to provide access to a private web application hosted in an on-premises data center for a group of remote contractors. The contractors will use personal devices and must authenticate via SAML. The application uses HTTPS on port 443. Which Prisma Access feature should be used to securely publish this application without requiring a GlobalProtect agent?

An administrator is troubleshooting a Prisma Access mobile user who reports that DNS resolution for internal domains fails intermittently. The user is connected via GlobalProtect, and the internal DNS servers are reachable. The administrator suspects that DNS queries are being sent to the wrong DNS server due to split-tunnel configuration. Which log source should the administrator check to see which DNS server the client is using for internal queries?

An administrator is troubleshooting a Prisma Access deployment where mobile users authenticated through SAML intermittently lose access to internal resources after about an hour, though the GlobalProtect tunnel never drops. Reviewing logs shows the users still have valid tunnel sessions and assigned IP addresses. Which underlying condition is most likely causing the intermittent access loss?

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch office users cannot reach external websites. Which TWO configuration areas or logs should the administrator check to resolve this issue? (Choose two)

An administrator is reviewing the status of a Prisma Access deployment using Prisma Access Insights. Which THREE key metrics or insights can be viewed through this tool? (Choose three)

An administrator configures a Service Connection in Prisma Access to reach an on-premises Active Directory domain controller for authentication. Users are able to log in, but User-ID is failing to map IP addresses to usernames for users behind the Remote Network. What is the most likely reason for this User-ID failure?

Users in a specific region are experiencing intermittent latency and packet loss when accessing SaaS applications through Prisma Access. The administrator wants to analyze the quality of the path between the remote network location and the Prisma Access cloud node. Which Prisma Access feature should be utilized?

A network engineer is troubleshooting an IPsec site-to-site tunnel failure between a customer CPE and a Prisma Access Remote Network. The IKE phase 1 negotiations fail. Which log should the engineer examine to determine the exact reason for the IKE negotiation failure?

An administrator is troubleshooting a Prisma Access issue where mobile users cannot access a specific internal application hosted on-premises. The application is reachable via a Service Connection. The administrator has verified that the Service Connection is up and that the application is accessible from the Service Connection's tunnel interface. What is the most likely cause of the issue?

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

An enterprise using Prisma Access has configured a Service Connection to their primary data center. Users at remote branches report that they cannot reach internal applications hosted in the data center. Upon checking Panorama, the Service Connection status shows 'Connected', but routing is failing. What configuration step is required on Prisma Access to advertise the remote network subnets to the data center?

An administrator is troubleshooting why mobile users cannot access a private application through Prisma Access ZTNA. The administrator has verified that the application is configured correctly and that the user is in the correct group. Which log type in Prisma Access should be examined to determine if the connection is being blocked by a security policy?

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

A Prisma Access administrator is troubleshooting an issue where mobile users intermittently lose access to all applications for a few seconds. The administrator suspects an issue with the GlobalProtect tunnel. Which tool should the administrator use to view the tunnel status and identify flapping?

An organization requires that all DNS queries from Prisma Access mobile users be inspected and filtered for malicious domains before resolving. Where in Panorama is Prisma Access DNS Security configured?

When configuring Prisma Access for ZTNA 2.0 to control access to private applications, which TWO components or configurations are mandatory for establishing least-privileged application access? (Choose two)

When designing a multi-region Prisma Access architecture, an architect must consider compute locations and routing preferences. Which THREE factors influence the selection and placement of compute locations? (Choose three)

An organization notices that mobile users connecting to Prisma Access from a specific country are experiencing high latency and frequent disconnections. The administrator wants to check the regional Prisma Access node performance and status. Which feature in Panorama provides regional status and cloud infrastructure metrics?

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch users experience slow throughput to SaaS applications. The IPsec tunnel to Prisma Access is up, but performance is degraded. The administrator suspects that traffic is not being forwarded to the optimal Service Connection. Which action should the administrator take to verify that Prisma Access is selecting the correct egress point for the branch?

An administrator is configuring Prisma Access to secure outbound internet traffic from a remote network site. The administrator wants to ensure that all traffic from the branch is inspected by Prisma Access security services, including threat prevention and URL filtering, before reaching the internet. Which Prisma Access component must be configured to direct branch traffic to the cloud security services?

Which security feature in Prisma Access SWG inspects downloaded executable files and documents against a cloud-based behavioral sandbox to identify zero-day malware?

A Prisma Access administrator is troubleshooting a remote network where users cannot reach a SaaS application that is accessed via a Service Connection. The administrator confirms that the IPsec tunnel is up and that the Service Connection is healthy. Which configuration element should the administrator verify next to ensure that traffic from the remote network is routed to the Service Connection?

An architect is designing a Prisma Access deployment for a global enterprise that requires low-latency connectivity for remote workers across North America, Europe, and Asia. Which component should the architect deploy to ensure traffic processing occurs closest to the user's geographical location?

A network engineer is configuring Prisma Access and needs to verify the status of deployed Mobile User nodes across different regions. Which Panorama workspace is dedicated to displaying the overall health and status of Prisma Access infrastructure?

An administrator needs to configure secure access for remote networks using dynamic routing (BGP). Where are the BGP peer parameters, local AS number, and peer AS configured in Prisma Access?

An organization uses SAML authentication with Prisma Access for mobile users. Users report an intermittent 'Authentication Failed' error when trying to establish a GlobalProtect connection. The Identity Provider (IdP) logs show successful authentication, but Prisma Access logs indicate a failure. What is the most likely cause of this discrepancy?

An administrator configures a new Service Connection in Prisma Access to allow mobile users to access resources in the corporate data center. However, traffic from mobile users cannot reach the data center. The administrator confirms that the IPsec tunnel is up. What is the most likely cause of this issue in Panorama?

A security administrator notices that Prisma Access is not enforcing a URL Filtering profile for traffic from a specific Remote Network. The profile is applied in a security policy rule that matches the Remote Network's source zone. The administrator confirms the rule is present and enabled. What is the most likely cause?

An administrator is deploying Prisma Access and needs to ensure that remote users can access internal applications hosted in a data center. The data center is connected to Prisma Access via a service connection. The administrator wants to avoid exposing internal IP addresses to the internet. Which Prisma Access component should be used to securely route traffic from remote users to the data center?

A network engineer is configuring a Service Connection in Prisma Access to connect the cloud security infrastructure back to the corporate data center. Which routing protocol is supported natively by Prisma Access to dynamically exchange routes over the IPsec VPN tunnel?

A security engineer is configuring Prisma Access to enforce threat prevention on all traffic from remote networks. The engineer wants to ensure that the threat prevention profile is applied to both inbound and outbound traffic. Where should the engineer attach the threat prevention profile in the Prisma Access policy?

An administrator troubleshooting a Prisma Access environment notices that specific traffic is bypassing security inspection. Upon checking the Security Policy, the administrator sees that a security rule has the profile setting set to 'None'. What does this configuration mean for traffic matching that rule?

An administrator is configuring Prisma Access for a remote network that uses a single IPsec tunnel to a Prisma Access service connection. The remote network has two ISP links: a primary link and a backup link. The administrator wants to ensure that if the primary link fails, traffic automatically fails over to the backup link without manual intervention. Which Prisma Access feature should be configured to achieve this?

An organization is deploying Prisma Access for mobile users and needs to ensure that users in Europe connect to European cloud nodes while users in North America connect to North American nodes. How does Prisma Access automatically achieve this geographic routing?

An administrator wants to ensure high availability and resilient connectivity for mobile users connecting to Prisma Access. Which TWO features or mechanisms are utilized by Prisma Access to ensure reliable mobile user access? (Choose two)

A security engineer is configuring Prisma Access to inspect traffic from remote networks. The requirement is to apply different security policies based on the source IP address of the traffic. Which configuration object in Prisma Access should be used to define the source IP addresses for policy enforcement?

An administrator is configuring Prisma Access for the first time and needs to ensure that mobile users can resolve internal domain names. The administrator has enabled DNS proxy in the Mobile Users settings. Which additional configuration is required to resolve internal domains?

When troubleshooting a Prisma Access deployment where traffic from remote users is failing Threat Prevention inspection, which TWO components or configurations must be verified? (Choose two)

An enterprise is planning a Prisma Access deployment and wants to optimize performance and redundancy for Remote Networks. Which THREE best practices should the network architect follow when designing IPsec connections to Prisma Access? (Choose three)

A security team wants to ensure that all traffic from mobile users to sanctioned SaaS applications is inspected for data patterns while traffic to unsanctioned applications is blocked. Which Prisma Access policy type should the administrator configure to enforce this per-application control?

An administrator is troubleshooting a Prisma Access explicit proxy deployment where users report that specific web applications are failing with connection timeout errors. Which THREE areas should the administrator check? (Choose three)

An administrator has deployed Prisma Access with a single service connection to an on-premises data center. Branch users at a remote network report that traffic to an internal application hosted behind the data center firewall is being dropped, even though Security policy allows it. The administrator confirms the remote network tunnel is up and the service connection is green. Which configuration element should the administrator verify to allow the branch-to-data-center traffic to traverse the Prisma Access infrastructure?

An administrator is configuring Prisma Access for mobile users and wants to ensure that all traffic to and from the internet is inspected by the Secure Web Gateway (SWG) service. The administrator has enabled the SWG license and configured a security policy rule to allow web traffic. However, users report that they can access malicious websites that should be blocked. What is the most likely missing configuration?

A Prisma Access administrator is troubleshooting a mobile user who reports that they can connect via GlobalProtect but cannot access any internal resources. The administrator suspects that the issue is related to the user's group mapping. Which log type in Prisma Access should the administrator review to verify user-to-group mapping?

A Prisma Access administrator is troubleshooting a remote network deployment where users experience intermittent connectivity failures. The administrator notices that the IPsec tunnel frequently flaps. Which component should the administrator check to determine if the tunnel is being renegotiated due to mismatched proposal settings?

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

An administrator notices that the Panorama management server is failing to push configuration updates to Prisma Access nodes. Where should the administrator check for configuration push failure details and error logs in Panorama?

A Prisma Access administrator is troubleshooting GlobalProtect mobile users who intermittently lose access to internal applications reachable through a service connection. The administrator confirms the service connection IPsec tunnels are up and BGP routes are present, but the users' sessions drop roughly every 30 minutes. Which action should the administrator take first to isolate the cause?

An administrator is configuring Prisma Access for a new remote network site. The site has a single ISP link and requires high availability for the IPSec tunnel to Prisma Access. The administrator wants to ensure that if the primary Prisma Access gateway becomes unavailable, the tunnel automatically fails over to a secondary gateway. Which feature should the administrator configure on the remote network device?

An administrator is troubleshooting a connectivity issue where remote mobile users cannot reach internal private applications via Prisma Access ZTNA. Which THREE diagnostic steps or verification checks should the administrator perform? (Choose three)

An administrator is troubleshooting a CASB inline policy where a specific file upload to an unapproved SaaS application was not blocked. Upon checking the Security policy, the rule has the correct application identified. What is the most likely reason the inline action failed to trigger?

An administrator is reviewing Prisma Access logs to investigate a security incident. The administrator needs to identify which user accessed a specific malicious URL. Which log type in Prisma Access provides the user identity along with the URL and action taken?

An administrator needs to ensure that Prisma Access mobile users are authenticated using multi-factor authentication (MFA) before accessing corporate resources. Which Prisma Access component is responsible for enforcing MFA?

An administrator wants to deploy Secure Web Gateway (SWG) capabilities in Prisma Access to prevent users from uploading company proprietary data to unauthorized cloud storage applications. Which Prisma Access profile type should be applied to the Security Policy rules to achieve this?

An administrator is troubleshooting a Prisma Access mobile user deployment where GlobalProtect clients are unable to connect. Which THREE components or settings should the administrator inspect to resolve the connection failure? (Choose three)

Which TWO configuration steps are required to allow internet access for Remote Network users?

An administrator is troubleshooting a policy where applications are being identified incorrectly in Prisma Access. Which tool should be used to inspect how Prisma Access performs App-ID identification on a live stream of packets?

A Prisma Access administrator notices that a specific remote network tunnel shows as up, but the branch users cannot reach any internet destinations. The tunnel interface on the branch CPE is up, and the administrator can ping the Prisma Access service IP. Which log type on the Prisma Access side should the administrator review first to determine whether traffic is being dropped by a security policy?

An administrator wants to configure Prisma Access Secure Web Gateway to block access to sites categorized as 'Gambling' during working hours, but allow them during lunch breaks. Which Panorama feature enables time-based policy enforcement?