SSE-Engineer practice questions 31–40

1. Question 31 · 56 in bank

   How can a senior engineer use Strata Cloud Manager (SCM) to ensure that junior engineers are able to create compliant policies while preventing the creation of policies that may result in security gaps?

   • AUse security checks under posture settings and set the action to “deny” for all checks that do not meet the compliance standards.
   • BConfigure role-based access controls (RBACs) for all junior engineers to limit them to creating policies in a disabled state, manually review the policies, and enable them using a senior engineer role.
   • CConfigure an auto tagging rule in SCM to trigger a Security policy review workflow based on a security rule tag, then instruct junior engineers to use this tag for all new Security policies.
   • DRun a Best Practice Assessment (BPA) at regular intervals and manually revert any policies not meeting company compliance standards.

   Show answer

   Answer: A

   Next question

2. Question 32 · 56 in bank

   Which policy configuration in Prisma Access Browser (PAB) will protect an organization from malicious BYOD and minimize the impact on the user experience?

   • AOne that blocks file exchange
   • BOne for session recording
   • COne that blocks elements such as screen scrapers
   • DOne that allows access to applications with data masking or watermarking

   Show answer

   Answer: D

   Next question

3. Question 33 · 56 in bank

   During a deployment of Prisma Access (Managed by Strata Cloud Manager) for mobile users, a SAML authentication type and authentication profile in the Cloud Identity Engine application is successfully created. Using this SAML authentication, what is a valid next step to configure authentication for mobile users?

   • APerform a full commit to Strata Cloud Manager so the Cloud Identity Engine profiles get synchronized from the application.
   • BPermit the Cloud Identity Engine service account RBAC access to the mobile user folder in Strata Cloud Manager.
   • CIn Strata Cloud Manager, create a new authentication type of “Cloud Identity Engine.”
   • DCreate a SAML authentication profile in Strata Cloud Manager and link it to the Cloud Identity Engine profile.

   Show answer

   Answer: D

   Next question

4. Question 34 · 56 in bank

   After configuring domain-based split tunnel for zoom.us, how is expected behavior on the client machine confirmed?

   • AVerify from the routing table.
   • BEnable dump level logs on GlobalProtect Application.
   • CVerify zoom.us is resolved by the tunnel assigned DNS server.
   • DPing zoom.us from the CLI.

   Show answer

   Answer: B

   Next question

5. Question 35 · 56 in bank

   Which Cloud Identity Engine capability will create a Security policy that uses Entra ID attributes as the source identification?

   • AEntra ID Group Attribute
   • BAttribute Group Mapping
   • CEntra ID Cloud Group
   • DCloud Dynamic User Group

   Show answer

   Answer: D

   Next question

6. Question 36 · 56 in bank

   An engineer deploys a new branch connected to Prisma Access. From the customer premises equipment (CPE) device at the branch, Phase 1 on the tunnel is established, but Phase 2-encrypted packets are not coming back from Prisma Access. Which Strata Logging Service log facility should the engineer review to determine why Phase 2-encrypted traffic is not being received?

   • ADecrypt logs
   • BSystem logs
   • CTraffic logs
   • DTunnel logs

   Show answer

   Answer: B

   Next question

7. Question 37 · 56 in bank

   When configuring Remote Browser Isolation (RBI) with Prisma Access (Managed by Strata Cloud Manager), which element is required to define the protected URLs for mobile users?

   • AA URL access management profile with site access set to “Isolate” applied to a Security policy
   • BA DNS Security profile applied to a Security policy with the action of “Isolate” for the target remote browser DNS categories
   • CAn RBI profile applied to the URL access management profile
   • DA Security policy with the target URL categories and set the action to “Isolate”

   Show answer

   Answer: A

   Next question

8. Question 38 · 56 in bank

   A malicious user is attempting to connect to a blocked website by crafting a packet using a fake SNI and the correct website in the HTTP host header. Which option will prevent this form of attack?

   • AAdvanced Threat Prevention option to block “Domain Fronting”
   • BAdvanced URL Filtering and block the “Malicious Behavior” category
   • CAdvanced URL Filtering and block “SNI mismatch with Server Certificate (SAN/CN)”
   • DSSL Decryption to “Block sessions on SNI mismatch with Server Certificate (SAN/CN)”

   Show answer

   Answer: D

   Next question

9. Question 39 · 56 in bank

   Select 2

   A user connected to Prisma Access reports that traffic intermittently is denied after matching a Catch-All Deny rule at the bottom and bypassing HIP-based policies. Refreshing VPN connection restores the access. What are two reasons for this behavior? (Choose two.)

   • A“Collect HIP data” needs to be enabled in the configuration.
   • BUser mapping is learned from sources other than gateway authentication.
   • CFirewall loses user mapping due to missed HIP report checks.
   • DHIP-enforced policy is scheduled for certain hours of the day.

   Show answer

   Answer: BC

   Next question

10. Question 40 · 56 in bank

    Which feature can help address a customer concern about the length of time it takes to update their SaaS-allowed IP addresses while onboarding to Prisma Access?

    • ADynamic IP pooling
    • BDNS-based load balancing
    • CTraffic steering
    • DDedicated IP addresses

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SSE-Engineer practice, question 31. 56 questions available.