Prisma Access Planning And Deployment practice questions

Destination NAT rules on the Service Connections

Why it fails: Destination NAT is used for inbound traffic, not for resolving overlapping branch source subnets.

GRE tunneling with static default routes

Why it fails: GRE tunneling alone does not resolve overlapping IP address spaces.

BGP AS-Path Prepending across all branch tunnels

Why it fails: AS-Path prepend is used for route selection and path manipulation, not for overlapping IP mitigation.

The BGP hold timer is set higher than 180 seconds

Why it fails: Hold timers do not prevent route installation if the BGP session is successfully established.

BGP authentication type is set to MD5 instead of SHA-256

Why it fails: Prisma Access supports MD5 and standard BGP authentication; mismatch would prevent peering entirely rather than accepting peers without installing routes.

The Autonomous System Number (ASN) is a private 4-byte ASN

Why it fails: Prisma Access supports both public and private ASNs for BGP peering.

By utilizing VRRP across the cloud public IP addresses

Why it fails: VRRP cannot be configured across cloud-managed Prisma Access public endpoints.

By enabling Spanning Tree Protocol (STP) over the IPsec tunnel interfaces

Why it fails: STP is not supported over Prisma Access IPSec tunnels.

By configuring LACP bonding directly across the cloud IPSec endpoints

Why it fails: LACP is a Layer 2 link aggregation protocol and cannot be run across cloud-terminated IPSec tunnels.

Always-On VPN with Disconnect Lockout

Why it fails: Always-On reconnects automatically but Enforced Mode specifically restricts user tampering.

Clientless VPN Portal redirection

Why it fails: Clientless VPN is for browser-based access and does not control agent behavior.

GlobalProtect App Lockdown Policy

Why it fails: App Lockdown is not the correct Palo Alto Networks feature name; Enforced Mode is.

GlobalProtect Portal

Why it fails: GlobalProtect Portal distributes VPN client configuration and authentication to endpoints; it does not push security policy, configuration, or software to SPNs. Panorama or Strata Cloud Manager performs that management-plane role. The portal is correct when deploying endpoint VPN access with agent configuration and user authentication.

AWS Transit Gateway Manager

Why it fails: AWS Transit Gateway Manager administers AWS-native transit gateway attachments and route tables, not Prisma Access SPN policy. It cannot push security rules, configuration, or software to cloud-managed SPNs. It is the right tool when connecting VPCs and on-premises networks through AWS transit gateways, unrelated to Prisma Access management.

Prisma Access Cloud Controller

Why it fails: The Cloud Controller is not Prisma Access's management plane; that role belongs to Panorama or Strata Cloud Manager, which push policy, configuration, and software to cloud-managed SPNs. The Cloud Controller handles orchestration and service connectivity. It would be relevant when managing cloud infrastructure resources rather than security policy.

Deploy a physical hardware firewall inside the AWS cloud VPC

Why it fails: Prisma Access is fully managed by Palo Alto Networks; customers do not deploy physical firewalls in the cloud VPC.

Configure LACP active-active bonding on the Service Connection tunnel interfaces

Why it fails: LACP is not supported across cloud IPSec service connections.

Enable static default routing without configuring any routing protocols

Why it fails: Service Connections require dynamic routing (BGP) rather than static routing.

Prisma Access Remote Network BGP ASN

Why it fails: BGP ASN is configured under Remote Networks or Service Connections, not GlobalProtect client settings.

Service Connection public gateway IP address

Why it fails: Service Connection IPs are part of site-to-site architecture, not mobile client settings.

To authenticate GlobalProtect users against Active Directory

Why it fails: GlobalProtect user authentication relies on SAML, certificates or LDAP against Active Directory, entirely separate from address translation. It is tempting because SNAT changes how traffic appears, but it operates at layer 3 and carries no identity information; authentication happens before any NAT decision.

To replace the requirement for BGP routing over Service Connections

Why it fails: SNAT rewrites source addresses and cannot substitute for BGP, which exchanges routes between Prisma Access and the customer premises over Service Connections. It is tempting because SNAT hides internal addressing, but designs still require BGP peering; SNAT only prevents overlapping or private prefixes clashing.

To assign dynamic IPv6 addresses to individual remote worker laptops

Why it fails: SNAT translates IPv4 source addresses and has no role in IPv6 address assignment, which SLAAC or DHCPv6 handles on the endpoint. It is tempting because NAT is associated with address management, but remote worker laptops receive addresses locally; SNAT applies to Remote Network egress traffic instead.

Verify that local branch DHCP lease times are set to 8 hours

Why it fails: DHCP lease times are unrelated to cloud-level branch-to-branch routing rules.

Check that all mobile user clients have disabled split tunneling

Why it fails: Branch-to-branch routing involves remote networks/branches, not mobile client split tunneling settings.

Destination NAT (DNAT) on the remote network

Why it fails: Destination NAT (DNAT) translates the destination IP of incoming traffic, typically used for port forwarding or publishing internal services. It does not affect outbound traffic source IP addresses. The requirement is to change the source IP of outbound traffic to a specific public IP, so DNAT is not applicable here.

Policy-Based Forwarding (PBF) with a dedicated egress IP

Why it fails: Policy-Based Forwarding (PBF) can direct traffic based on policies, but it does not provide source IP translation. PBF is used for routing decisions, such as directing traffic to a specific ISP or service, but it does not alter the source IP address. The scenario requires a change of source IP, which PBF alone cannot achieve.

Source NAT (SNAT) on the remote network

Why it fails: Source NAT (SNAT) is used to translate the source IP of traffic originating from the remote network, but it does not provide a separate public IP for outbound traffic. SNAT is typically used to hide internal IPs or to comply with external service requirements, not to assign a unique public IP for all outbound traffic. The scenario requires a dedicated public IP, which is achieved through a different mechanism.

Specify a Diffie-Hellman group for perfect forward secrecy.

Why it fails: Diffie-Hellman groups are used during IKE phase 1 and phase 2 to establish session keys. While PFS is a best practice, it is not a mandatory companion parameter to the encryption algorithm in the IPSec profile itself. The question asks for the parameter that completes the profile with AES-256-GCM; DH group is configured separately in the IKE gateway or crypto profile.

Select SHA-512 as the authentication algorithm to complement AES-256-GCM.

Why it fails: AES-256-GCM already includes authentication, so pairing it with SHA-512 is unnecessary and can lead to a misconfigured profile. Some platforms reject such combinations or ignore the hash, but best practice is to leave the authentication field blank. Selecting SHA-512 would not enhance security and may cause interoperability issues with the remote peer.

Configure a separate authentication algorithm because GCM provides encryption only.

Why it fails: AES-256-GCM is an authenticated encryption with associated data (AEAD) cipher that combines encryption and integrity protection. It does not require a separate authentication algorithm; specifying one would be redundant and may cause configuration conflicts. The IPSec profile for GCM typically omits the authentication field, as integrity is handled internally by the GCM mode.

Configure GlobalProtect to use client certificates for authentication.

Why it fails: Client certificates are used for authentication but do not directly enable User-ID. User-ID requires mapping IP addresses to usernames, which is typically done via GlobalProtect agent or other methods. While certificates can authenticate users, they don't provide the IP-to-user mapping needed for User-ID. Therefore, this configuration alone does not satisfy the requirement.

Set up LDAP integration for user authentication.

Why it fails: LDAP integration is used for authenticating users, but it does not directly enable User-ID mapping. While LDAP can be used for authentication, User-ID requires the mapping of IP to username, which is provided by the GlobalProtect agent or portal. LDAP alone does not provide this mapping. Therefore, it is not a required configuration for User-ID with GlobalProtect.

Configure a User-ID agent on the Prisma Access side.

Why it fails: A User-ID agent is typically used for on-premises firewalls to map IPs to users via directory services. In Prisma Access, User-ID for GlobalProtect users is handled through the GlobalProtect infrastructure, not a separate User-ID agent. While User-ID agents can be used for other sources, they are not required for GlobalProtect users. Thus, this is not a required configuration.

Prisma Access for Networks

Why it fails: Prisma Access for Networks is designed for remote network and service connection deployments, providing site-to-site connectivity and traffic inspection for branch offices and data centers. It does not include remote user licensing, so it would not support the 50,000 mobile users. Therefore, this license type alone is not appropriate.

Prisma Access for Networks plus Remote User add-on

Why it fails: Prisma Access for Networks plus a Remote User add-on is not a standard licensing option. Palo Alto Networks offers separate licenses for users and networks, and the Remote User add-on does not exist as described. This option misrepresents the available licensing structure and would not provide the required capabilities.

Prisma Access for Users

Why it fails: Prisma Access for Users provides secure web gateway and firewall capabilities for mobile users but does not include the ability to connect to internal resources through a service connection, which requires the additional Service Connection license. This license alone would not meet the requirement for internal resource access, making it insufficient for the scenario.

Weight

Why it fails: Weight is a Cisco-specific attribute and is not used in Prisma Access BGP configuration. Even if it were available, weight is locally significant and only affects the router on which it is configured. In Prisma Access, the service connection and remote network are managed by the infrastructure, and weight is not a supported attribute for influencing path selection.

AS Path

Why it fails: AS Path is used to influence BGP route selection by adding AS numbers to the path. However, in Prisma Access, the service connection and remote network are part of the same logical network, and manipulating AS Path may not effectively prefer one over the other. The service connection is typically preferred by default due to its direct connection to the data center, and AS Path manipulation is more relevant for external BGP peering.

Multi-Exit Discriminator (MED)

Why it fails: MED is used to influence inbound traffic from an external AS, suggesting a preferred entry point. It is not used for outbound path selection within the same AS. Since the service connection and remote network are both within Prisma Access, MED would not affect the preference for outbound traffic to the data center. Therefore, MED is not the correct attribute.

Create a VPN tunnel and configure RIP version 2 for route exchange.

Why it fails: RIP is not supported for dynamic routing in Prisma Access. The scenario requires BGP, and RIP would not be a valid choice. Additionally, while a VPN tunnel is part of the Remote Network connection, RIP is not a supported routing protocol for this integration, making this option incorrect.

Configure a static route on the Remote Network firewall pointing to Prisma Access.

Why it fails: Static routes do not enable dynamic BGP peering. While a static route could provide basic reachability, it does not fulfill the requirement for BGP routing with the data center. BGP requires a configured peer relationship, not just a static route. The scenario explicitly requires BGP, so static routing is insufficient.

Enable OSPF on the Service Connection to redistribute routes into BGP.

Why it fails: OSPF is not used for routing between Prisma Access and Remote Networks. Prisma Access supports BGP for dynamic routing with Remote Networks and Service Connections. Enabling OSPF would not provide the required BGP peering and would not meet the scenario's requirement for BGP routing with the data center.

The Service Connection must use a /29 subnet to accommodate the Transit Gateway's requirement for a minimum of five IP addresses.

Why it fails: The subnet size for the IPSec tunnel is not dictated by the Transit Gateway. Prisma Access Service Connections typically use a /30 subnet for the point-to-point tunnel. A /29 is unnecessary and may cause configuration mismatches. The requirement is to verify BGP and ASN, not the subnet size, as the tunnel endpoints are defined by the Service Connection configuration.

The Service Connection must be configured with a static route pointing to the on-premises network via the Transit Gateway.

Why it fails: Static routes are not supported for Service Connections. Prisma Access uses BGP to exchange routes dynamically over the IPSec tunnel. A static route would not be advertised to the remote networks or mobile users, and the Transit Gateway would not receive the necessary prefixes, breaking return traffic. The engineer must verify BGP configuration, not static routing.

The Service Connection must be configured with OSPF area 0 to exchange routes with the Transit Gateway.

Why it fails: OSPF is not supported for Prisma Access Service Connections. Prisma Access only supports BGP for dynamic routing over Service Connections. Using OSPF would result in no route exchange and traffic would not be routed correctly. The engineer must use BGP, not OSPF, for this deployment.

Enable 'Traffic Stealing' on the Service Connection to redirect traffic to the security processing nodes.

Why it fails: Prisma Access does not have a feature called 'Traffic Stealing' for Service Connections. Traffic is naturally routed through the security processing nodes when the Service Connection is configured with the appropriate routing and security policies. This option is a fictional term and would not achieve the desired inspection.

Configure the Service Connection with the 'Security Inspection' option enabled.

Why it fails: While security inspection is the goal, there is no standalone 'Security Inspection' checkbox in the Service Connection configuration. Inspection is applied by security policies on the Prisma Access side. The Service Connection simply provides the tunnel; policies are enforced by the security processing nodes based on the traffic's source and destination zones.

Configure a static route on the Remote Network firewall pointing to the Prisma Access service IP.

Why it fails: A static route on the Remote Network firewall directs traffic to Prisma Access, but it does not ensure that traffic is inspected by security policies. The Service Connection itself must be properly configured to allow traffic to be routed through the security processing nodes. Static routing alone does not enforce inspection; the Service Connection setup and security policy application are required.

Advertise the data center routes with a higher local preference over the Service Connection.

Why it fails: Local preference is used within an autonomous system to influence outbound traffic. Since Prisma Access and the data center are likely in different autonomous systems, local preference would not affect the path selection between the Service Connection and Remote Network VPN. The engineer needs to influence inbound traffic to Prisma Access, so local preference is not the right tool here.

Advertise the data center routes with a higher AS path length over the Service Connection.

Why it fails: A higher AS path length would make the route less preferred, which is the opposite of what is needed. The engineer wants Prisma Access to prefer the Service Connection, so the AS path should be shorter, not longer. AS path manipulation is typically used to influence outbound traffic, not inbound.

Advertise the data center routes with a lower weight over the Service Connection.

Why it fails: Weight is a Cisco-specific attribute and is not used in Prisma Access BGP configuration. Moreover, weight is local to the router and influences outbound path selection, not inbound. Since Prisma Access does not use weight, this option is invalid for the scenario.

Create a security policy rule that allows traffic from the remote network to the internet.

Why it fails: Creating a security policy rule is part of the process, but it alone does not ensure that traffic is inspected by security processing nodes. The traffic must first be directed to Prisma Access through proper routing and tunnel configuration. Policy rules are applied after traffic reaches Prisma Access, so this step is necessary but not sufficient.

Assign a security zone to the remote network tunnel interface.

Why it fails: Assigning a security zone is necessary for policy enforcement, but it does not by itself ensure that traffic is routed to Prisma Access. The traffic must be directed to the tunnel first. Zone assignment is part of the configuration but is not the step that enables traffic inspection; routing is the key.

Enable SSL decryption on the remote network firewall.

Why it fails: SSL decryption is a security feature that allows inspection of encrypted traffic, but it is not required to enable basic traffic inspection. The question asks for the step to enable traffic to be inspected at all, not to decrypt it. SSL decryption would be an additional configuration for deeper inspection, but not the primary requirement here.

The Prisma Access Insights portal

Why it fails: Prisma Access Insights is a monitoring and analytics tool. It provides visibility into the deployment but does not enforce traffic steering or security policies. It cannot direct traffic or apply inspection rules. The enforcement is done by the Security Processing Nodes, not by the Insights portal.

The Remote Network's local firewall

Why it fails: The local firewall at the Remote Network does not enforce Prisma Access traffic steering policies. It may route traffic to Prisma Access, but the decision to inspect internet-bound traffic while bypassing inspection for data center traffic is made by Prisma Access itself. The local firewall cannot differentiate based on Prisma Access service policies.

The Service Connection

Why it fails: The Service Connection provides connectivity between Prisma Access and the data center, but it does not enforce traffic steering policies. It is a transport mechanism. The decision to inspect or bypass traffic is made by the security processing nodes based on policy, not by the Service Connection itself.