Palo Alto Networks PSE-SASE Exam Questions Instant Access

Question 1

Which three decryption methods are available in a security processing node (SPN)? (Choose three.)

ASSL Outbound Proxy

BSSHv2 Proxy

CSSL Forward Proxy

DSSL Inbound Inspection

ESSH Inbound Inspection

Answer : B, C, D

Question 2

Which action protects against port scans from the internet?

AApply App-ID Security policy rules to block traffic sourcing from the untrust zone.

BAssign Security profiles to Security policy rules for traffic sourcing from the untrust zone.

CApply a Zone Protection profile on the zone of the ingress interface.

DAssign an Interface Management profile to the zone of the ingress surface.

Answer : C

Question 3

How can a network engineer export all flow logs and security actions to a security information and event management (SIEM) system?

AEnable syslog on the Instant-On Network (ION) device.

BUse a zone-based firewall to export directly through application program interface (API) to the SIEM.

CEnable Simple Network Management Protocol (SNMP) on the Instant-On Network (ION) device.

DUse the centralized flow data-export tool built into the controller.

Answer : A

Question 4

What can prevent users from unknowingly downloading potentially malicious file types from the internet?

AApply a File Blocking profile to Security policy rules that allow general web access.

BApply a Zone Protection profile to the untrust zone.

CAssign an Antivirus profile to Security policy rules that deny general web access.

DAssign a Vulnerability profile to Security policy rules that deny general web access.

Answer : A

Question 5

Which product continuously monitors each segment from the endpoint to the application and identifies baseline metrics for each application?

AApp-ID Cloud Engine (ACE)

BAutonomous Digital Experience Management (ADEM)

CCloudBlades

DWildFire

Answer : B

Question 6

Which two prerequisites must an environment meet to onboard Prisma Access mobile users? (Choose two.)

AZoning must be configured to require a user ID for the mobile users trust zone.

BMapping of trust and untrust zones must be configured.

CBGP must be configured so that service connection networks can be advertised to the mobile gateways.

DMobile user subnet and DNS portal name must be configured.

Answer : A, D

Question 7

How does a secure web gateway (SWG) protect users from web-based threats while still enforcing corporate acceptable use policies?

AUsers are mapped via server logs for login events and syslog messages from authenticating services.

BIt uses a cloud-based machine learning (ML)-powered web security engine to perform ML-based inspection of web traffic in real-time.

CIt prompts the browser to present a valid client certificate to authenticate the user.

DUsers access the SWG, which then connects the user to the website while still performing security measures.

Answer : D

Palo Alto Networks Systems Engineer (PSE): SASE Associate PSE-SASE Exam Questions