SSE-Engineer practice questions 11–20

1. Question 11 · 56 in bank

   Select 2

   Based on the image below, which two statements describe the reason and action required to resolve the errors? (Choose two.)

   

   • AThe client is misconfigured.
   • BCreate a do not decrypt rule for the hostname “google.com.”
   • CThe server has pinned certificates.
   • DCreate a do not decrypt rule for the hostname “certificates.godaddy.com.”

   Show answer

   Answer: BC

   Next question

2. Question 12 · 56 in bank

   A company has a Prisma Access deployment for mobile users in North America and Europe. Service connections are deployed to the data centers on these continents, and the data centers are connected by private links. With default routing mode, which action will verify that traffic being delivered to mobile users traverses the service connection in the appropriate regions?

   • AConfigure BGP on the customer premises equipment (CPE) to prefer the assigned community string attribute on the mobile user prefixes in its respective Prisma Access region.
   • BConfigure each service connection to filter out the mobile user pool prefixes from the other region in the advertisements to the data center.
   • CConfigure BGP on the customer premises equipment (CPE) to prefer the MED attribute on the mobile user prefixes in its respective Prisma Access region.
   • DConfigure each service connection to prepend the BGP ASN five times for mobile user pool prefixes originating from the other region.

   Show answer

   Answer: B

   Next question

3. Question 13 · 56 in bank

   An engineer has configured a Web Security rule that restricts access to certain web applications for a specific user group. During testing, the rule does not take effect as expected, and the users can still access blocked web applications. What is a reason for this issue?

   • AThe rule was created with improper threat management settings.
   • BThe rule was created in the wrong scope, affecting only GlobalProtect users instead of all users.
   • CThe rule was created at a higher level in the rule hierarchy, giving priority to a lower-level rule.
   • DThe rule was created at a lower level in the rule hierarchy, giving priority to a higher-level rule.

   Show answer

   Answer: D

   Next question

4. Question 14 · 56 in bank

   What will cause a connector to fail to establish a connection with the cloud gateway during the deployment of a new ZTNA Connector in a data center?

   • AThere is a misconfiguration in the DNS settings on the connector.
   • BThe connector is deployed behind a double NAT.
   • CThe connector is using a dynamic IP address.
   • DThere is a high latency in the network connection.

   Show answer

   Answer: A

   Next question

5. Question 15 · 56 in bank

   Which feature will fetch user and group information to verify whether a group from the Cloud Identity Engine is present on a security processing node (SPN)?

   • ASASE Health Dashboard
   • BUser Activity Insights
   • CPrisma Access Locations
   • DRegion Activity Insights

   Show answer

   Answer: C

   Next question

6. Question 16 · 56 in bank

   Select 2

   An engineer configures User-ID redistribution from an on-premises firewall connected to Prisma Access (Managed by Panorama) using a service connection. After committing the configuration, traffic from remote network connections is still not matching the correct user-based policies. Which two configurations need to be validated? (Choose two.)

   • AEnsure the Remote_Network_Template is selected when adding the User-ID Agent in Panorama.
   • BConfirm there is a Security policy configured in Prisma Access to allow the communication on port 5007.
   • CConfirm the Collector Pre-Shared Keys match between Prisma Access and the on-premises firewall.
   • DEnsure the Service_Conn_Template is selected when adding the User-ID Agent in Panorama.

   Show answer

   Answer: CD

   Next question

7. Question 17 · 56 in bank

   What is the purpose of embargo rules in Prisma Access?

   • ARate-limiting connections originating from specific countries
   • BAllowing traffic only from specific countries
   • CBlocking connections from specific countries
   • DBlocking traffic from Russia, China, and North Korea only

   Show answer

   Answer: C

   Next question

8. Question 18 · 56 in bank

   Strata Logging Service is configured to forward logs to an external syslog server; however, a month later, there is a disruption on the syslog server. Which action will send the missing logs to the external syslog server?

   • AConfigure a replay profile with the affected time range and associate it with the affected syslog server profile.
   • BDelete the affected syslog server profile and create a new one.
   • CExport the logs from Strata Logging Service, and then manually import them to the syslog server.
   • DConfigure a log filter under the syslog server profile with the affected time range.

   Show answer

   Answer: A

   Next question

9. Question 19 · 56 in bank

   A large retailer has deployed all of its stores with the same IP address subnet. An engineer is onboarding these stores as Remote Networks in Prisma Access. While onboarding each store, the engineer selects the “Overlapping Subnets” checkbox. Which Remote Network flow is supported after onboarding in this scenario?

   • ATo private applications
   • BTo the internet
   • CTo remote network
   • DTo mobile users

   Show answer

   Answer: B

   Next question

10. Question 20 · 56 in bank

    An intern is tasked with changing the Anti-Spyware Profile used for security rules defined in the GlobalProtect folder. All security rules are using the Default Prisma Profile. The intern reports that the options are greyed out and cannot be modified when selecting the Default Prisma Profile. Based on the image below, which action will allow the intern to make the required modifications?

    

    • ARequest edit access for the GlobalProtect scope.
    • BChange the configuration scope to Prisma Access and modify the profile group.
    • CCreate a new profile, because default profile groups cannot be modified.
    • DModify the existing anti-spyware profile, because best-practice profiles cannot be removed from a group.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SSE-Engineer practice, question 11. 56 questions available.