📘 Free SSE-ENGINEER Sample Questions
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to-
business (B2B) partners to their data centers.
The solution must meet these requirements:
The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.
The branch locations must have internet filtering and data center connectivity.
The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports.
The security team must have access to manage the mobile user and access to branch locations.
The network team must have access to manage only the partner access.
How should Prisma Access be implemented to meet the customer requirements?
A
Deploy two Prisma Access instances - the first with mobile users, remote networks, and private access for all internal connection types,
and the second with remote networks and private application access for B2B connections - and use the Strata Multitenant Cloud Manager
Prisma Access configuration scope to manage access.
B
Deploy a Prisma Access instance with mobile users, remote networks, and private access for all connection types, and use the Prisma
Access Configuration scope to manage all access.
C
Deploy two Prisma Access instances - the first with mobile users, remote networks, and private access for all internal connection types,
and the second with remote networks and private application access for B2B connections - and use the specific configuration scope for the
connection type to manage access.
D
Deploy a Prisma Access instance with mobile users, remote networks, and private access for all connection types, and use the specific
configuration scope for the connection type to manage access.
Correct Answer:
B. Deploy a Prisma Access instance with mobile users, remote networks, and private access for all connection types, and use the Prisma
Access Configuration scope to manage all access.
Explanation:
Option D is correct because it consolidates all access management within a single Prisma Access instance while allowing distinct
configurations for different connection types.
Prisma Access is designed to facilitate secure connections for varied user types, ensuring that policies can be specifically tailored to meet
distinct requirements. By deploying a single instance with mobile users, remote networks, and private access for all connection types,
organizations can maximize efficiency and reduce complexity. Utilizing the specific configuration scope for connection types allows for
granular policy enforcement while maintaining a unified management framework, fulfilling diverse access needs without spawning
unnecessary overhead.
Option A is incorrect as it proposes two separate instances which can complicate management and integration. Maintaining two instances
increases operational complexity and can lead to higher administrative burdens.
Option B fails to account for the need for different access needs between mobile users, branch locations, and B2B partners. A single
instance managing all types without specific configuration scopes would not allow for the necessary segregation of access policies,
jeopardizing security and compliance.
Option C, while proposing two instances, does not clarify the effective use of configuration scopes and thus risks introducing inefficient
management practices that could hinder operational agility. Two Prisma Access instances would potentially lead to excessive complexity,
conflicting policies, and increased latency in policy propagation across user types.
In summary, Option D effectively balances simplicity in management while still meeting the diverse access requirements outlined in the
use case.
References:
https://www.paloaltonetworks.com/products/secure-access-service-edge/prisma-access
https://www.paloaltonetworks.com/documentation/prisma/access
https://www.paloaltonetworks.com/resources/whitepapers/prisma-access-for-sase-architecture
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to-
business (B2B) partners to their data centers.
The solution must meet these requirements:
The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.
The branch locations must have internet filtering and data center connectivity.
The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports.
The security team must have access to manage the mobile user and access to branch locations.
The network team must have access to manage only the partner access.
How can the engineer configure mobile users and branch locations to meet the requirements?
A
Use GlobalProtect and Remote Networks to filter internet traffic and provide access to data center resources using service connections.
B
. Use Explicit Proxy to filter internet traffic and provide access to data center resources using service connections.
C
Use GlobalProtect to filter internet traffic and provide access to data center resources using service connections.
D
Use Explicit Proxy and Remote Networks to filter internet traffic and provide access to data center resources using service connections.
Correct Answer:
A. Use GlobalProtect and Remote Networks to filter internet traffic and provide access to data center resources using service connections.
Explanation:
A. Use GlobalProtect and Remote Networks to filter internet traffic and provide access to data center resources using service connections.
The choice of GlobalProtect in conjunction with Remote Networks is optimal for providing the necessary security and connectivity for
mobile users and branch locations. GlobalProtect establishes secure VPN connections, enabling mobile users to access data center
resources while applying internet filtering as needed. Remote Networks extend these capabilities to branch locations by establishing site-
to-site connections, efficiently routing traffic between remote branches and the central data center while maintaining robust security
policies. This integration allows for comprehensive visibility and management capabilities, which align perfectly with the security team's
need to manage both mobile users and branch locations.
Critique of Other Options:
B. Use Explicit Proxy: While this option includes internet filtering, it does not provide direct access to data center resources effectively for
mobile users and branches. Explicit proxies lack the capability to establish secure tunnels or VPNs necessary for comprehensive
connectivity.
C. Use GlobalProtect: This option fails to mention the incorporation of Remote Networks to establish crucial interconnectivity between
branch locations and the data center. It limits utility by not addressing the needs of branch locations outside of direct mobile user
connectivity.
D. Use Explicit Proxy and Remote Networks: Similar to option B, while Remote Networks would support branch connections, an explicit
proxy does not adequately filter traffic for mobile users or maintain the necessary management of dynamic traffic, neglecting essential
security policies.
By leveraging GlobalProtect combined with Remote Networks, businesses can ensure secure and efficient connectivity, meeting all
specified requirements for users, branches, and partners.
References:
1. https://www.paloaltonetworks.com/products/cloud-security/prisma-access
2. https://www.paloaltonetworks.com/resources/technical-documentation
3. https://www.paloaltonetworks.com/documentation/tech-docs/partners/globalprotect/wp/overview-globalprotect
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to-
business (B2B) partners to their data centers.
The solution must meet these requirements:
The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.
The branch locations must have internet filtering and data center connectivity.
The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports.
The security team must have access to manage the mobile user and access to branch locations.
The network team must have access to manage only the partner access.
Which two options will allow the engineer to support the requirements? (Choose two.)
A
Configure the CPE with Static Routes pointing to Prisma Access Infrastructure and Mobile User routes.
B
Enable eBGP for dynamic routing and configure RemoteNetworks.
C
.Configure Remote Networks and define the branch IP subnets using Static Routes.
D
Enable Remote Networks Advertise Default Route.
Correct Answer:
B. Enable eBGP for dynamic routing and configure RemoteNetworks.
Explanation:
B. Enable eBGP for dynamic routing and configure Remote Networks.
Prisma Access supports dynamic route exchange with customer CPE using eBGP. Using eBGP for at least some Remote Networks
simplifies route distribution (mobile-user prefixes, DC prefixes, branch prefixes) and scales better than all-static routing. This supports the
branches, partners and mobile-user connectivity requirements when you want dynamic route exchange.
C. Configure Remote Networks and define the branch IP subnets using Static Routes.
Remote Networks are the mechanism used to connect branch and partner locations into Prisma Access. For sites where you do not want or
cannot run BGP you can register the branch subnets as Remote Networks and have the CPE advertise/point static routes for those
subnets to the Prisma Access tunnel — which satisfies branch connectivity and internet-filtering requirements.
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to-
business (B2B) partners to their data centers.
The solution must meet these requirements:
The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.
The branch locations must have internet filtering and data center connectivity.
The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports.
The security team must have access to manage the mobile user and access to branch locations.
The network team must have access to manage only the partner access.
Which two components can be provisioned to enable data center connectivity over the internet? (Choose two.)
A
ZTNA Connector
B
SD-WAN Connector
C
.Service connections
D
Colo-Connect
Correct Answer:
A. ZTNA Connector
Explanation:
AC is correct because ZTNA Connector and SD-WAN Connector effectively enable secure data center connectivity while accommodating
varying user requirements within Prisma Access.
The ZTNA Connector offers secure access to internal applications via Zero Trust principles, ensuring that the mobile users can connect to
data centers without compromising security. By deploying ZTNA, organizations can enforce granular access controls for mobile users,
aligning with compliance needs and the specific requirement for B2B partners.
The SD-WAN Connector complements this by optimizing connectivity for branch locations, delivering both performance and security
when accessing data centers. This feature allows for increased reliability and bandwidth management, vital for interconnected sites, while
still enabling necessary internet filtering.
Conversely, the Service Connections option does not inherently provide the targeted access or the routing capabilities necessary for
mobile users and branch locations, limiting its effectiveness in this multi-faceted scenario. While it facilitates the integration of various
services, it lacks the direct capabilities for data center connectivity that the options A and B offer.
Lastly, Colo-Connect primarily serves as a physical layer connection for data centers rather than enabling users' direct access over the
internet. This limits its utility in contexts requiring scalable and flexible remote user access.
For an in-depth understanding, refer to:
https://www.paloaltonetworks.com/products/secure-access-service-edge
https://www.paloaltonetworks.com/resources/whitepapers/engineering-prisma-access
https://www.paloaltonetworks.com/documentation/prisma/prisma-access/getting-started-overview/policies-in-prisma-access
Which two actions can a company with Prisma Access deployed take to use the Egress IP API to automate policy rule updates when the IP
addresses used by Prisma Access change? (Choose two.)
A
Configure a webhook to receive notifications of IP address changes.
B
Copy the Egress IP API Key in the service infrastructure settings.
C
Enable the Egress IP API endpoint in Prisma Access.
D
Download a client certificate to authenticate to the Egress IP API.
Correct Answer:
A. Configure a webhook to receive notifications of IP address changes.
Explanation:
AB is correct because these actions facilitate real-time updates to policy rules by leveraging the Egress IP API to respond to dynamic
changes in IP addresses used by Prisma Access.
To delve deeper, configuring a webhook (Option A) allows for immediate notification and response to IP address changes, ensuring that the
policy rules are up-to-date without manual intervention. This automation is crucial in maintaining security posture and operational
efficiency as IP addresses can change frequently in cloud environments. Additionally, copying the Egress IP API Key (Option B) is essential
for integrating this API into the existing infrastructure, as it authenticates the requests made for IP information thus enabling seamless
automation of policy updates based on real-time data.
In contrast, Option C (enabling the Egress IP API endpoint) might appear necessary but it does not directly contribute to automation;
simply enabling the endpoint without utilizing it does not invoke action on policy changes. Option D (downloading a client certificate) is
related to authentication but does not specifically address the operational need to automate policy rule updates. While authentication is
vital, the steps to actively use the API for policy automation are more critical than merely securing access.
In summary, Options A and B directly address the need for automation in policy updates using the Egress IP API, while options C and D
either lack direct relevance to the task at hand or serve as supplementary actions rather than primary solutions.
References:
https://www.paloaltonetworks.com/resources/faq/what-is-prisma-access
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLihCAG
https://www.paloaltonetworks.com/cyberpedia/how-to-use-the-egress-ip-api-in-prisma-access
How can an engineer verify that only the intended changes will be applied when modifying Prisma Access policy configuration in Strata Cloud
Manager (SCM)?
A
Review the SCM portal for blue circular indicators next to each configuration menu item and ensure only the intended areas of
configuration have this indicator.
B
Compare the candidate configuration and the most recent version under “Config Version Snapshots.”
C
Select the most recent job under Operations > Push Status to view the pending changes that would apply to Prisma Access.
D
Open the push dialogue in SCM to preview all changes which would be pushed to Prisma Access.
Correct Answer:
B. Compare the candidate configuration and the most recent version under “Config Version Snapshots.”
Explanation:
B. Compare the candidate configuration and the most recent version under “Config Version Snapshots.”
In Strata Cloud Manager (SCM) for Prisma Access, all configuration changes are first stored in a candidate configuration (similar to
Panorama or firewall candidate configs).
Before committing or pushing those changes, an engineer can compare:
The current candidate configuration
against
The most recently committed (running) configuration,
using the Config Version Snapshots feature.
This comparison clearly highlights exactly what changes will be applied — including additions, deletions, and modifications — ensuring that
only the intended edits are included in the upcoming push.
When using the traffic replication feature in Prisma Access, where is the mirrored traffic directed for analysis?
A
Specified internal security appliance
B
Dedicated cloud storage location
C
Panorama
D
Strata Cloud Manager (SCM)
Correct Answer:
B. Dedicated cloud storage location
Explanation:
B. Dedicated cloud storage location."When enabling Traffic Replication, Prisma Access creates dedicated cloud storage buckets in each
Prisma Access Compute Location where this feature is enabled and continuously saves pcap files containing a replica of the traffic that’s
traversing Prisma Access." https://docs.paloaltonetworks.com/prisma-access/administration/prisma-access-advanced-
deployments/mobile-user-globalprotect-advanced-deployments/traffic-mirroring
Evaluation of Incorrect Options:
A. Specified internal security appliance: This option is flawed because Prisma Access is a cloud-based service and primarily targets
remote locations and users, making the direction of traffic to an internal appliance counter to its operational design, which focuses on
cloud scalability.
C. Panorama: While Panorama provides centralized management for Palo Alto Networks devices, it does not function as a repository for
replicated traffic. Instead, its role focuses on policy and configuration management rather than traffic storage.
D. Strata Cloud Manager (SCM): SCM is oriented towards managing security posture across singular or multiple cloud environments, but
it is not an analysis or data storage center for replicated traffic streams. As such, using SCM for traffic replication undermines its intended
purpose.
For further exploration of traffic replication in Prisma Access and its implications in security architecture, please refer to the following
sources:
1. Palo Alto Networks Prisma Access Overview
2. Understanding Traffic Replication in Prisma Access
3. Traffic Analysis and Monitoring with Prisma Access
When a review of devices discovered by IoT Security reveals network routers appearing multiple times with different IP addresses, which
configuration will address the issue by showing only unique devices?
A
Add the duplicate entries to the ignore list in IoT Security.
B
. Merge individual devices into a single device with multiple interfaces.
C
Create a custom role to merge devices with the same hostname and operating system.
D
Delete all duplicate devices, keeping only those discovered using their management IP addresses.
Correct Answer:
B. . Merge individual devices into a single device with multiple interfaces.
Explanation:
B is correct because merging individual devices into a single device with multiple interfaces consolidates data, preventing duplication and
ensuring accurate device representation.
Merging individual devices enhances operational efficiency by presenting a unified view of network resources. In IoT Security, routers may
appear with varying IP addresses when scoped in different roles or upon reconnections. Merging recognizes the physical continuity of
these devices, aggregating their functionalities, potential vulnerabilities, and configurations while eliminating redundancies. This
preserves historical data integrity and simplifies monitoring and management efforts, ultimately improving the overall security posture.
A. Add the duplicate entries to the ignore list in IoT Security.
References
C. Create a custom role to merge devices with the same hostname and operating system.
This option merely hides the duplicates rather than addressing the underlying problem of data fragmentation, leading to an inaccurate
overview of the network. Ignoring entries also risks missing critical alerts and security vulnerabilities associated with these devices.
While this option emphasizes device identification, it overly simplifies the merging criteria by focusing solely on hostname and OS. Not all
devices of the same type operate under identical circumstances; thus, crucial distinctions may be overlooked, leading to potential
misconfigurations.
D. Delete all duplicate devices, keeping only those discovered using their management IP addresses.
Deleting duplicates without proper analysis can result in the permanent loss of valuable operational data tied to previous IP addresses. It
can hinder network diagnostics and historical performance evaluations, which are essential for effective security management.
https://www.paloaltonetworks.com/documentation/secure-the-network
https://www.cisecurity.org/white-papers/securing-iot-devices-and-networks
https://www.nist.gov/publications/iot-security-and-privacy-research-challenges-and-opportunities
What is the impact of selecting the “Disable Server Response Inspection” checkbox after confirming that a Security policy rule has a threat
protection profile configured?
A
. Only HTTP traffic from the server to the client will bypass threat inspection.
B
. The threat protection profile will override the “Disable Server Response Inspection” only for HTTP traffic from the server to the client.
C
All traffic from the server to the client will bypass threat inspection.
D
The threat protection profile will override the “Disable Server Response Inspection” for all traffic from the server to the client.
Correct Answer:
C. All traffic from the server to the client will bypass threat inspection.
Explanation:
C is correct because selecting the "Disable Server Response Inspection" checkbox deactivates threat inspection for all traffic from the
server to the client, effectively circumventing any threat protections configured within the profile.
Reasoning: When the "Disable Server Response Inspection" option is activated, it instructs the firewall to forgo inspecting the responses
from the server entirely. This action occurs irrespective of any threat protection profiles tied to the security policies. Therefore, any
malicious content that might be present in server responses would proceed uninspected, increasing the organization's vulnerability to
threats penetrating through the server responses.
Critique of Other Options:
A: This statement incorrectly limits the scope of the disabling effect to only HTTP traffic, omitting other protocols that could be equally
affected. Hence, it fails to acknowledge the uniform application of the setting across all traffic types.
B: This option misrepresents priority dynamics, suggesting that the threat protection profile would take precedence for HTTP traffic. This
contradicts the fundamental premise of disabling inspections, which uniformly negates threat protection.
D: This option suggests an incorrect hierarchy where the threat protection profile would override the disabled setting for all traffic, which
is inaccurate. The disabling of server response inspection inherently negates the role of any applied threat protection profile.
This understanding of threat inspection dynamics is critical for effective network security management, as it highlights the risks
associated with traffic types that may be unchecked. The responsible deployment of inspection settings is essential to safeguard
organizational assets.
References:
https://www.paloaltonetworks.com/resources/technical-papers/secure-application-development
https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os-admin-complete-guide/introduction-to-monitoring-and-
troubleshooting
https://www.paloaltonetworks.com/blog/2020/04/palo-alto-networks-security-policy-best-practices/
A company has a Prisma Access deployment for mobile users in North America and Europe. Service connections are deployed to the data
centers on these continents, and the data centers are connected by private links.
With default routing mode, which action will verify that traffic being delivered to mobile users traverses the service connection in the
appropriate regions?
A
Configure BGP on the customer premises equipment (CPE) to prefer the assigned community string attribute on the mobile user prefixes
in its respective Prisma Access region.
B
Configure each service connection to filter out the mobile user pool prefixes from the other region in the advertisements to the data
center.
C
Configure BGP on the customer premises equipment (CPE) to prefer the MED attribute on the mobile user prefixes in its respective
Prisma Access region.
Correct Answer:
B. Configure each service connection to filter out the mobile user pool prefixes from the other region in the advertisements to the data
center.
Explanation:
B is correct because configuring each service connection to filter out mobile user pool prefixes from the other region ensures traffic is
delivered through the appropriate Prisma Access service connection.
Reasoning:
The necessity of regional traffic segregation in a Prisma Access deployment arises from connectivity optimization and compliance with
region-specific regulations. By filtering out prefixes associated with mobile users from other regions, the service connections specifically
ensure that user traffic is processed only within the intended geographic confines. This guarantees that performance and latency are
optimized for users in North America and Europe, as traffic will not be inadvertently rerouted or cross the regional demarcations
established by the service connections.
Critical Evaluation of Other Options:
A. Configure BGP on the customer premises equipment (CPE) to prefer the assigned community string attribute on the mobile user
prefixes in its respective Prisma Access region.
This option is insufficient because while preferential routing can influence traffic paths based on community strings, it does not prevent
misrouting of traffic. Community strings are subject to the broader BGP routing decisions, meaning they might still direct traffic across
regions.
C. Configure BGP on the customer premises equipment (CPE) to prefer the MED attribute on the mobile user prefixes in its respective
Prisma Access region.
region.
rules, similarly to option A.
References:
While MED (Multi-Exit Discriminator) can influence route selection, it provides a preferential method rather than a definitive mechanism
for enforcing regional traffic segregation. MED operates based on the competence of neighboring ASes to recognize and prioritize, which
may not guarantee adherence to regional routing requirements.
D. Configure each service connection to prepend the BGP ASN five times for mobile user pool prefixes originating from the other
BGP AS path prepending can deter route selection by making paths appear less favorable; however, it does not eliminate the risk of traffic
being routed through undesired regions. This approach is more about influencing routing metrics rather than enforcing traffic routing
https://www.paloaltonetworks.com/resources/demos/prisma-access-multi-region-architecture
https://www.paloaltonetworks.com/resources/demos/prisma-access-best-practices
https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/202932-Configuring-BGP-MED.html
Questions: 1-10 out of 68
Continue Full Practice..
GET ALL 68 QUESTIONS