SSE-Engineer Prisma Access Troubleshooting Practice Question
Which TWO tools or logs in Panorama should an administrator use when troubleshooting a security policy rule that is unexpectedly dropping legitimate user traffic in Prisma Access? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Monitor > Logs > Traffic to identify sessions marked with a 'deny' action and note the matching rule name.
Debugging dropped traffic involves examining Traffic logs for session deny actions and using the test security-policy-match command to evaluate rule logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Monitor > Logs > Traffic to identify sessions marked with a 'deny' action and note the matching rule name.
Why this is correct
Traffic logs record dropped sessions, showing the exact rule ID that blocked the connection.
- ✗
Device > High Availability status.
Why it's wrong here
High availability status shows appliance redundancy, not traffic policy enforcement.
- ✓
The CLI command 'test security-policy-match' to simulate traffic and verify rule evaluation.
Why this is correct
This command tests policy matching for specific parameters to see which rule takes precedence.
- ✗
Monitor > Dynamic Updates > Status.
Why it's wrong here
Dynamic updates show signature download status, not traffic policy drops.
- ✗
Panorama > Cloud Services > Audit Log.
Why it's wrong here
Audit logs track configuration changes, not live traffic drops.
About these practice questions
This SSE-Engineer question is part of Courseiva's 203-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This SSE-Engineer practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSE-Engineer exam.