Hard Difficulty Questions

Configure policy-based forwarding on the Service Connection

Why it fails: Policy-based forwarding is used on firewalls to direct traffic based on policy, but it does not itself create different security policy outcomes for subnets within the same Service Connection. The requirement is to apply distinct security policies, which is achieved through destination-based rules rather than forwarding.

Create separate Service Connections for production and development subnets

Why it fails: Creating separate Service Connections would require additional IPSec tunnels and on-premises configuration, which the scenario explicitly seeks to avoid. It also increases management overhead and does not leverage existing routing. While it would allow separate policies, it contradicts the requirement to avoid deploying separate Service Connections.

Apply different decryption profiles to the Service Connection tunnel

Why it fails: Decryption profiles control SSL and SSH inspection behavior, not which security policy applies to a subnet. They do not differentiate traffic by destination subnet for policy enforcement. Using them here would not achieve separate security treatment for production versus development traffic.

Policies -> NAT

Why it fails: NAT policies govern IP address translation.

Panorama -> Cloud Services -> GlobalProtect -> DNS

Why it fails: GlobalProtect portal settings assign client DNS servers, but do not configure security inspection profiles.

Network Services -> DNS Proxy

Why it fails: DNS Proxy handles local network DNS forwarding, not cloud security profile enforcement.

Deploy a Prisma Access Service Connection to proxy endpoint security telemetry to Panorama.

Why it fails: Service Connections carry traffic between Prisma Access and internal networks or Panorama; they do not transport endpoint HIP telemetry from Mobile Users. It is tempting because Service Connections do link Panorama, but HIP data flows through GlobalProtect agent communication, so this would fit only a question about reaching internal resources.

Configure the Cloud Identity Engine to query local endpoint registries directly for antimalware signatures.

Why it fails: The Cloud Identity Engine resolves identity from directories such as Microsoft Entra ID; it does not query endpoint registries for antimalware signatures. It is tempting because it centralises identity data, but HIP checks depend on the GlobalProtect agent's host profile, so this would be correct for directory-based user authentication.

Enable User-ID syslog mapping to ingest antimalware status logs from third-party endpoint protection servers.

Why it fails: User-ID syslog mapping populates user-to-IP mappings for policy, not endpoint posture attributes; HIP requires the GlobalProtect agent reporting to Prisma Access. It is tempting because both ingest external telemetry, but syslog parsing yields identity, whereas HIP needs the agent's host profile data, so this suits user-based rules instead.

Explicit Proxy PAC file redirect

Why it fails: Explicit Proxy PAC files redirect web browser traffic to a proxy; they do not establish routing between Prisma Access mobile users and remote network service connections. It is tempting because PAC files do steer client traffic, but that is for web proxy selection, not the branch-to-branch direct peering path this scenario requires.

Prisma Access Insights Regional Peering

Why it fails: Prisma Access Insights is a monitoring and telemetry service reporting on health, users, and traffic; it does not create or enable the direct peering path between mobile users and remote networks. It is tempting because its regional dashboards appear related, but it observes traffic rather than routing it.

Clean Pipe architecture

Why it fails: Clean Pipe is a Prisma Access security subscription providing denial-of-service and threat protection for remote networks; it does not govern the routing path between mobile users and remote networks. It is tempting because it is a Prisma Access feature, but it filters malicious traffic rather than enabling direct branch-to-branch flow.

Disable all multi-factor authentication (MFA) requirements on Prisma Access portals.

Why it fails: Disabling MFA removes an authentication control rather than configuring CIE to consume directory group data, so group-based policy enforcement gains nothing. It is tempting because MFA prompts can complicate portal logins during testing, and disabling MFA would be valid only where a separate identity provider already enforces it upstream.

Install the GlobalProtect agent directly on all domain controller servers acting as CIE proxies.

Why it fails: GlobalProtect belongs on user endpoints for tunnel and HIP collection, not on domain controllers, which run the CIE proxy service to query AD. Installing it there adds no authentication path and may disrupt the directory role.

Manually export user CSV files daily and upload them to Panorama using the CLI.

Why it fails: CIE maintains live directory synchronisation through its proxy or agent, so scheduled CSV exports are unnecessary and stale between uploads; group membership changes would not be reflected promptly. CSV import suits isolated environments with no direct directory connectivity.

System logs on the Prisma Access portal

Why it fails: System logs capture events such as configuration changes and service status, not client DNS server assignments. They will not show which DNS server the client is using for internal queries. Thus, they cannot help diagnose split-DNS issues on the endpoint.

HIP match logs in the Prisma Access gateway

Why it fails: HIP match logs show endpoint compliance results based on Host Information Profile checks. They do not contain DNS configuration or query details. Using them to troubleshoot DNS resolution would be ineffective because they are unrelated to DNS server selection.

Traffic logs filtered by DNS application

Why it fails: Traffic logs may show DNS sessions if they are logged, but they typically do not record the DNS server IP used by the client for a specific query. They can indicate that DNS traffic occurred, but not which server was queried or the split-DNS decision. Therefore, they are less useful for this specific issue.

Configure a static route to the on-premises network.

Why it fails: A static route does not enable dynamic BGP peering. While it can provide reachability, BGP is required to exchange routes dynamically and to support failover. The scenario specifies BGP, so a static route alone would not meet the requirement. Static routes are typically used as a backup or for simple topologies, not for dynamic peering with private AS numbers.

Set up an IPSec tunnel with BGP over it.

Why it fails: Service Connections already use IPSec tunnels by default; you don't need to set up an additional tunnel. The question is about enabling BGP peering over the existing Service Connection. Adding another tunnel would complicate the setup and is unnecessary. The correct approach is to configure BGP parameters within the Service Connection configuration, not to create a separate tunnel.

Configure OSPF on the Service Connection.

Why it fails: OSPF is a link-state IGP, not an EGP like BGP. The on-premises network uses BGP, so OSPF would not interoperate. While OSPF can be used in some Prisma Access deployments, it is not the correct choice when the remote side is BGP. Configuring OSPF would not establish peering with the BGP-speaking router, leading to routing failures.

The total number of IP addresses in the branch local DHCP scope

Why it fails: DHCP scope size limits how many hosts can obtain addresses; it does not measure throughput demand. It is tempting because IP counts hint at user numbers, but bandwidth licensing is driven by concurrent traffic volume, so scope size would matter when planning subnet capacity, not licence tier.

The number of active BGP peers configured on the branch router

Why it fails: BGP peer count governs routing adjacency scale, not throughput; video streaming load is measured in concurrent sessions and Mbps per user, which drive the bandwidth licence calculation. BGP sizing matters when the Remote Network terminates many dynamic routing peers, a separate capacity dimension from streaming demand.

The maximum transmission unit (MTU) size configured on the IPSec tunnel

Why it fails: MTU affects packet fragmentation and overhead on the IPSec tunnel, not the licensed throughput ceiling. Bandwidth licences are sized on aggregate traffic volume, so MTU is tempting because it influences tunnel performance, but it would matter when tuning throughput efficiency, not when choosing a licence tier.

The Service Connection's tunnel interface is not advertising the application's subnet to Prisma Access.

Why it fails: If the Service Connection is up and the application is reachable from its tunnel interface, routing is likely fine. The Service Connection advertises routes to Prisma Access, but if it weren't, the application wouldn't be reachable from the tunnel interface. The issue is more likely policy-related.

The mobile user's DNS is not resolving the application's FQDN to the correct IP address.

Why it fails: DNS resolution issues would prevent access, but the scenario implies the application is reachable via Service Connection, suggesting IP connectivity is the focus. If DNS were the issue, it would affect all access, not just from mobile users. The most likely cause is a policy misconfiguration.

The mobile user's GlobalProtect app is not configured to include the application's subnet in the split tunnel.

Why it fails: If the application's subnet is not included in the split tunnel, traffic would bypass the VPN and not reach Prisma Access. However, the scenario states the application is reachable via Service Connection, implying it should go through Prisma Access. The issue is more likely a policy or routing problem within Prisma Access, not split tunnel exclusion.

Verify the WildFire cloud analysis subscription status.

Why it fails: WildFire cloud analysis inspects files and URLs for malware; it has no role in BGP peering or route exchange, so a subscription status cannot explain unlearned routes. It is tempting because licence and subscription checks often resolve feature failures, and WildFire subscription status would be the correct thing to verify when cloud file analysis or inline malware verdicts are unavailable.

Check the GlobalProtect portal SSL certificate expiration date.

Why it fails: GlobalProtect portal certificates secure end-user VPN authentication, not the IPSec or BGP session carrying remote network routes. It is tempting because expired certificates cause connectivity failures elsewhere, but route learning depends on tunnel, peering and prefix configuration, not portal certificate validity.

URL filtering logs

Why it fails: URL filtering logs specifically record web traffic categorization and filtering actions. They are a subset of traffic logs and may not include non-web private application traffic. They would not provide comprehensive details about security policy enforcement for all application types.

Data filtering logs

Why it fails: Data filtering logs are generated when data patterns are detected and actions are taken, such as blocking or alerting. They are not used to troubleshoot basic access control issues. They focus on data loss prevention rather than policy enforcement for connectivity.

Threat logs

Why it fails: Threat logs contain information about security threats detected by the firewall, such as viruses or spyware. They do not show policy enforcement actions for allowed or denied connections. While they are useful for security analysis, they are not the primary source for troubleshooting access control issues.

The Prisma Access system logs, filtering for GlobalProtect gateway events.

Why it fails: System logs capture gateway-level events but may not provide per-user tunnel flapping details. They are more useful for configuration changes or system errors. While they might show gateway restarts, they do not offer the granular tunnel state history that the app logs provide for a specific user.

The Prisma Access dashboard's GlobalProtect status page, checking the number of connected users.

Why it fails: The dashboard shows aggregate connection counts, not individual tunnel stability. A flapping tunnel might cause the user count to fluctuate, but this tool does not provide per-user disconnect reasons or timestamps. It is too high-level to diagnose intermittent tunnel drops for a specific user.

The traffic logs, filtering for denied sessions from the mobile user's IP address.

Why it fails: Traffic logs show session allow/deny decisions, not tunnel status. Intermittent loss of all applications suggests a tunnel issue, not a policy issue. Traffic logs would only show that sessions were denied or timed out, but not why the tunnel flapped. They are not the right tool for diagnosing tunnel instability.

The physical desk layout of employee cubicles in branch offices

Why it fails: Compute location placement depends on user geography, latency and traffic egress requirements, not office furniture arrangement. It is tempting because branch office characteristics do inform overall design, but cubicle layout has no bearing on where Prisma Access compute nodes are deployed or how traffic is routed.

The local power grid provider utilized by the cloud data center

Why it fails: Compute location selection depends on latency, data residency and traffic routing, not on which utility supplies the data centre's electricity. It is tempting because power resilience affects data centre viability generally, but Prisma Access placement is driven by user proximity and egress requirements, not grid providers.

Policies > QoS > Bandwidth Management.

Why it fails: QoS bandwidth management shapes and prioritises traffic on managed interfaces; it holds no telemetry on Prisma Access regional nodes or cloud infrastructure. It is tempting because QoS policies do address latency and throughput concerns, but they act on your own traffic rather than reporting provider-side node health.

Device > High Availability.

Why it fails: Device > High Availability shows firewall pair redundancy state, not regional Prisma Access node health or cloud infrastructure metrics. It is tempting because it is a Panorama device-status view, and would be correct when verifying failover between an active and passive firewall pair rather than inspecting regional service nodes.

Monitor > Traffic > GlobalProtect Analytics.

Why it fails: GlobalProtect Analytics reports user connectivity, gateway selection and tunnel events, not regional Prisma Access node performance or cloud infrastructure metrics. It is tempting because it does surface mobile-user experience data, which is the symptom here, but the required node-level status lives under the Prisma Access health monitoring views.

Check the GlobalProtect gateway selection logs on the portal

Why it fails: GlobalProtect gateway selection logs pertain to mobile user connections, not Remote Network IPsec tunnels. Remote Networks do not use GlobalProtect gateway selection; they are routed based on Service Connection configuration. Therefore, these logs are irrelevant to diagnosing Remote Network egress selection.

Review the IPsec tunnel statistics on the branch firewall

Why it fails: IPsec tunnel statistics on the branch firewall show packet counts, errors, and throughput on the tunnel itself, but they do not reveal how Prisma Access internally routes traffic to a Service Connection. The branch firewall only sees the encrypted tunnel to the Prisma Access ingress, not the subsequent egress selection.

Run a traceroute from the branch firewall to the SaaS application

Why it fails: A traceroute from the branch firewall will show the path to the Prisma Access ingress, but once traffic enters the Prisma Access infrastructure, the internal routing to the Service Connection is hidden. Traceroute cannot reveal which Service Connection Prisma Access uses for egress.

A service connection with a static IP address and BGP peering to the Prisma Access infrastructure.

Why it fails: A service connection is used for accessing internal resources or service infrastructure, not for directing branch internet-bound traffic to Prisma Access security services. While BGP peering may be involved in routing, a service connection alone does not ensure outbound internet traffic is inspected; it is primarily for inbound or private access.

A Prisma Access explicit proxy configuration for the branch office web browsers.

Why it fails: An explicit proxy configuration requires manual browser settings and only covers web traffic, not all outbound traffic. It also does not provide the same level of inspection as a remote network connection, which inspects all IP traffic. Therefore, it is insufficient for ensuring comprehensive security for all branch outbound traffic.

A GlobalProtect portal and gateway configuration for the branch office users.

Why it fails: GlobalProtect portal and gateway are used for mobile user connectivity, not for site-to-site branch traffic. While they provide security for mobile users, they do not direct remote network traffic to Prisma Access for inspection. Thus, this configuration would not meet the requirement for branch outbound traffic inspection.

The GlobalProtect client software license has expired on Panorama.

Why it fails: A Panorama licence governs management-plane features, not the SAML assertion exchange between the IdP and Prisma Access; an expired licence would not produce intermittent IdP-success, gateway-failure mismatches. It is tempting because licensing faults do block GlobalProtect connectivity, but only as blanket failures, not SAML-specific intermittency.

The User-ID agent service on the Panorama management server is stopped.

Why it fails: User-ID agents map IP addresses to usernames for policy enforcement; they do not process SAML assertions, so stopping the service cannot cause IdP-success, gateway-failure mismatches. It is tempting because User-ID failures do break user-based policy, and the agent is the right suspect when IP-to-user mapping is stale, not when SAML authentication itself fails.

WildFire cloud subscription has lapsed.

Why it fails: WildFire provides cloud sandboxing for file analysis and has no role in SAML assertion validation, so a lapsed subscription cannot cause authentication failures. It is tempting because subscription lapses do degrade Prisma Access security services, and WildFire is the correct culprit when threat inspection or file verdicts stop, not when logins fail.

The BGP hold timer is set higher than 180 seconds

Why it fails: Hold timers do not prevent route installation if the BGP session is successfully established.

BGP authentication type is set to MD5 instead of SHA-256

Why it fails: Prisma Access supports MD5 and standard BGP authentication; mismatch would prevent peering entirely rather than accepting peers without installing routes.

The Autonomous System Number (ASN) is a private 4-byte ASN

Why it fails: Prisma Access supports both public and private ASNs for BGP peering.

Verifying the IPSec tunnel status in Panorama.

Why it fails: Panorama's IPSec tunnel status shows site-to-site VPN health between firewalls, which is unrelated to whether a remote endpoint can reach a GlobalProtect gateway. Checking tunnels is correct when diagnosing branch-to-datacentre connectivity, not client gateway discovery.

Checking the User-ID Agent logs on-premises.

Why it fails: User-ID Agent logs record IP-to-username mapping for policy enforcement, not gateway reachability, so they cannot confirm whether the GlobalProtect portal or gateway responds. This log is the right place when investigating misidentified users or missing user mappings, not connection failures.

Restarting the Cloud Identity Engine service.

Why it fails: The Cloud Identity Engine handles directory synchronisation and identity resolution, so restarting it does nothing to restore gateway reachability. That service is the correct focus when user or group attributes fail to resolve, not when clients report 'Gateway not found'.

Traffic must be backhauled to the corporate data center via a Service Connection before reaching another branch.

Why it fails: Prisma Access supports direct branch-to-branch traffic routing through cloud nodes without data center backhauling.

Remote Networks cannot communicate with each other under any circumstance.

Why it fails: Inter-branch communication is a fully supported feature in Prisma Access.

Traffic is automatically bypassed and sent directly over public internet.

Why it fails: Prisma Access handles remote network routing through its cloud backbone.