CCNA Prisma Access Planning And Deployment Questions

To ensure all traffic, including internet-bound traffic, is inspected by Prisma Access, the GlobalProtect tunnel must be configured to route all traffic (0.0.0.0/0) through the tunnel. Additionally, split tunneling must be disabled so that no traffic bypasses the tunnel. This forces all traffic to the security processing nodes for inspection. This is the correct configuration for full traffic inspection.

Cloud On-Ramp is a Prisma Access feature designed to optimize routing for cloud applications. It allows traffic to be directed to the nearest Prisma Access location and then to the cloud application, reducing latency and improving performance. By enabling Cloud On-Ramp, the organization can ensure that cloud-bound traffic from remote networks is efficiently routed and inspected, meeting both security and performance requirements.

For remote users, Prisma Access uses GlobalProtect to connect users to the nearest compute location. The administrator needs to configure GlobalProtect and onboard users, which enables security policy enforcement. This is the minimal configuration because no Service Connections or Remote Network connections are needed when there are no internal resources to access.

Prisma Access Insights is the cloud-delivered analytics service that aggregates health, status and traffic telemetry across all Prisma Access regions and tenants. It provides the centralised, cross-region visibility the question requires, unlike per-firewall or per-region monitoring tools.

Prisma Access mobile users authenticate through the GlobalProtect portal, so the SAML 2.0 authentication profile is referenced in the GlobalProtect Portal configuration under Authentication. This binds the external IdP to the portal that mobile users connect to.

SPNs run the full security stack inline, performing URL filtering with real-time category lookups against the cloud database. This satisfies the governance requirement by enforcing granular web access policy at every processing node without backhauling traffic.

Dual branch routers with independent IPSec tunnels remove the single device and single tunnel as failure points, so losing one router or tunnel still leaves branch traffic flowing to Prisma Access. This directly satisfies the redundancy requirement for the Remote Network location.

Configuring two IPSec tunnels from the remote network to the same Prisma Access location, each using a different ISP, provides redundancy. If the primary ISP fails, traffic can fail over to the secondary tunnel over the secondary ISP. Prisma Access supports multiple tunnels per remote network, and this is a common design for high availability.

Prisma Access assigns virtual IPs to GlobalProtect clients automatically from its own pool, removing the need for external DHCP or manual configuration. This satisfies the mobile-user scenario's requirement for scalable, low-administration address assignment across distributed clients.

Prisma Access Remote Networks allow branch offices to connect to the closest security processing node, where traffic can break out to the internet locally after security inspection. This minimizes latency to SaaS applications because traffic does not need to backhaul to a central location. This is the intended design for optimizing SaaS access.

Remote Network is the Prisma Access component that connects branch offices to Prisma Access via IPSec tunnels, enabling internet-bound traffic to be secured. It is specifically designed for site-to-site connectivity from branch locations. This is the correct component to deploy for branch office internet security.

This design meets both requirements: internal traffic is routed through the Europe Service Connection to the data center, and internet-bound traffic is inspected at the nearest compute location, minimizing latency. Prisma Access allows policy-based routing to direct traffic based on destination, so internet traffic can be sent to the internet via local compute locations while internal traffic goes through the Service Connection.

Prisma Access supports a single tenant with multiple compute locations, and security policies are applied uniformly across all locations when using the same policy rules. GlobalProtect automatically selects the closest compute location, ensuring consistent enforcement. This meets the requirement for uniform security policy and optimal routing.

Mobile Users locations are the points of presence where remote users connect to Prisma Access. By enabling multiple locations and using GlobalProtect with the closest server selection, users automatically connect to the nearest available location. This minimizes latency and improves performance. The engineer should configure Mobile Users locations in North America and Europe to meet the requirement.

Prisma Access runs its Security Processing Nodes on Amazon Web Services and Google Cloud Platform, giving the service its global points of presence. These two providers host the SPNs that perform security inspection closest to users.

This is correct because directing all traffic to the Prisma Access tunnel ensures that internet-bound traffic from the branch is sent to Prisma Access for security inspection. The static route forces traffic through the IPSec tunnel, where Prisma Access applies security policies. This is a standard configuration for Remote Networks to achieve consistent security enforcement.

The Explicit Proxy Service in Prisma Access is specifically designed to handle explicit proxy traffic. It must be configured with a proxy server address and port, and appropriate security policies must be applied. This service inspects web traffic from users who manually configure their browsers to use a proxy, ensuring consistent security enforcement.

Mobile Users is the Prisma Access component that enables remote and mobile users to connect directly to Prisma Access using GlobalProtect. This allows users to access the internet and internal applications without backhauling traffic through the corporate data center. Configuring Mobile Users is essential for this scenario because it provides secure, direct connectivity for individual endpoints.

A Service Connection connects Prisma Access to the corporate data center, allowing remote users to access internal applications. By configuring the Service Connection and advertising the internal subnets, Prisma Access can route traffic from remote users to the data center. This is the correct component for private application access.

Commit validation in Prisma Access Cloud Management allows an administrator to preview configuration changes and catch errors before committing them to the production environment. It performs a syntax and dependency check, ensuring that the configuration is valid and will not cause service disruption. This directly satisfies the requirement to validate changes before pushing to production.

A service connection provides the IPSec tunnel and routing that carries headquarters-bound traffic from the data centre into Prisma Access, satisfying the requirement for secure connectivity to the corporate data centre rather than remote-user or internet-bound access.

By applying an inbound filter on the Service Connection to reject the default route, Prisma Access will not install the 0.0.0.0/0 route from the data center. This ensures that internet-bound traffic from Remote Networks is not sent back to the data center but instead is routed to the internet directly from Prisma Access, where it can be inspected. This is the correct method to prevent the default route from affecting traffic steering.

Bandwidth considerations are crucial for scalability and performance. Each Remote Network location must have sufficient ISP bandwidth to handle the expected traffic load. If the aggregate bandwidth is insufficient, traffic may be dropped or delayed. Additionally, Prisma Access has limits on the bandwidth per tunnel, so multiple tunnels may be needed. Therefore, the architect must consider both the ISP bandwidth and the total aggregate bandwidth required.

Prisma Access allows you to deploy multiple mobile user locations, each with its own set of Security Processing Nodes in the specified region. By assigning users to the nearest location, traffic is inspected locally, reducing latency. This directly satisfies the requirement for dedicated SPNs in each region.

Panorama centrally manages Prisma Access configuration, including remote network bandwidth allocation for each compute location, then pushes it to the service. This satisfies the requirement to define and deploy bandwidth settings from a single management plane.

To establish BGP peering over a Service Connection, you must enable BGP and configure the peer AS number and peer IP address. This allows Prisma Access to exchange routes with the on-premises router. The private AS number is supported, and the configuration is done in the Prisma Access service connection settings, ensuring dynamic routing and failover.

Prisma Access Remote Networks support multiple IPSec tunnels to different locations for redundancy. If one location becomes unavailable, traffic can fail over to the other tunnel. This provides high availability even with a single ISP connection, as the tunnels terminate at different Prisma Access points of presence. This is the recommended approach for redundancy.

The GlobalProtect gateway is the component that enforces security policies, including split tunneling, for connected remote users. It receives the split tunneling configuration from the Prisma Access configuration and applies it to user traffic. Thus, it is the correct answer because it directly controls how traffic is routed based on the split tunnel policy.

The Prisma Access infrastructure settings define the basic parameters such as the tenant name, the service connection type (e.g., IPSec or BGP), and the locations for mobile users and remote networks. These settings must be configured first because they determine how the rest of the deployment is structured. Without them, you cannot proceed to configure Remote Networks or Service Connections.

Bandwidth licensing for a remote network location is sized against the peak aggregate throughput demanded by all users simultaneously, not average usage. Video streaming drives sustained high bitrates, so this peak figure determines the licence tier that prevents congestion.

GlobalProtect split tunnelling with access routes and domains directs only the specified SaaS traffic outside the tunnel, so that traffic egresses directly to the internet rather than through Prisma Access processing nodes. This satisfies the stem's requirement to bypass cloud security inspection for those applications while other traffic remains protected.

Before any Remote Networks or Service Connections can be configured, the Prisma Access license must be activated and the infrastructure allocated. This process provisions the necessary security processing nodes and network components in the cloud. Without this step, the Prisma Access service is not available for configuration, making it the essential first step.

GlobalProtect client settings in Panorama push DNS server addresses to the endpoint agent, so split-tunnel DNS queries for internal domains resolve against corporate resolvers. Configuring primary and secondary addresses under Network Settings satisfies the requirement that internal DNS resolution be used while users are connected through the GlobalProtect app.

Configuring multiple IPSec tunnels to the same Remote Network location and enabling BGP allows for automatic failover. If the primary tunnel goes down, BGP will detect the failure and withdraw routes, causing traffic to use the secondary tunnel. This provides high availability without manual intervention. This is the recommended approach for redundant connectivity.

QoS profiles on Remote Network connections are attached within Panorama's Remote Network configuration under Bandwidth Allocation and QoS, so branch traffic egressing that tunnel receives classification and priority. Applying it there ensures VoIP from the branch is marked and scheduled ahead of lower-priority flows.

The Prisma Access plugin installs into Panorama and adds the Prisma Access configuration workflows, including service connections, remote networks and mobile users, to the Panorama interface. Without it, Panorama cannot manage or push Prisma Access configuration, so integration fails.

Prisma Access Insights surfaces real-time service health, cloud infrastructure status and tunnel state, satisfying the stem's requirement for operational visibility. It aggregates IPSec tunnel and infrastructure telemetry across all tenants, letting administrators detect outages and degraded connectivity without querying individual firewalls or Panorama directly.

Compute locations must sit near the users and sites they serve, so the geographic spread of remote workers and branch offices directly drives placement. This satisfies the stem's compute-location factor by minimising latency and backhaul for the majority of traffic.

Distributing SPNs across North America, Europe and Asia places security processing within each region, so remote workers' traffic is inspected at the nearest node rather than backhauled to a central location. This directly satisfies the low-latency requirement by minimising geographic distance between user and processing point.

A Service Connection in Prisma Access connects the Prisma Access infrastructure to a customer's data center or headquarters, allowing remote users to access internal applications without exposing them to the internet. It provides a secure, private connection and is the correct component for this scenario because it enables remote users to reach internal resources securely.