Palo Alto Networks SSE-Engineer Exam Questions Instant Access

Question 1

An engineer has configured a new Remote Networks connection using BGP for route advertisements. The IPSec tunnel has been established, but the BGP peer is not up.

Which two elements must the engineer validate to solve the issue? (Choose two.)

ASecret

BMRAI Timers

CPeer AS Number

DAdvertise Default Route Checkbox

Answer : A, C

The BGP peer not coming up despite an established IPSec tunnel indicates a potential BGP configuration issue.

Secret -- If MD5 authentication is configured for BGP, both Prisma Access and the Customer Premises Equipment (CPE) must have the same secret (authentication key). A mismatch will prevent BGP from establishing a session.

Peer AS Number -- The Autonomous System (AS) number of the BGP peer must match what is expected on both sides of the connection. If the AS number is incorrect, the BGP session will fail to establish.

By verifying these elements, the engineer can troubleshoot and establish a successful BGP peering session over the IPSec tunnel.

Question 2

Which two statements apply when a customer has a large branch office with employees who all arrive and log in within a five-minute time period? (Choose two.)

ADNS results are only cached for frequently used hostnames.

BMaximum pending TCP DNS requests is 64.

CMaximum number of TCP DNS retries is 3.

DDNS results are cached for 300 seconds.

Answer : B, C

When a large branch office experiences a high volume of employees logging in within a short time frame, the following apply:

Maximum pending TCP DNS requests is 64 -- This means that Prisma Access can queue up to 64 pending DNS requests over TCP before dropping additional requests. If more requests are received simultaneously, some may fail or experience delays.

Maximum number of TCP DNS retries is 3 -- If a DNS request fails over TCP, Prisma Access will attempt to retry the request up to three times before failing over to another method or returning an error.

Question 3

A customer using Prisma Access (Managed by Panorama) wants to monitor traffic patterns across all remote networks and use Strata Logging Service to gather insights on network usage. An engineer notices that some network data is missing from the Application Command Center (ACC).

What should the engineer do to ensure complete data visibility?

AReconfigure the Prisma Access remote networks to log directly to Panorama instead of using Strata Logging Service.

BVerify that the Panorama web interface has been configured to aggregate logs from both the Panorama data and RN-SPNs.

CEnable the Use Data for Pre-Defined Reports' setting in the Logging and Reporting configuration on Panorama.

DEnsure that log forwarding profiles are applied to all Prisma Access policies and directed to Strata Logging Service.

Answer : D

For complete data visibility in Prisma Access (Managed by Panorama), log forwarding profiles must be applied to all security policies to ensure that traffic logs are correctly sent to Strata Logging Service. If log forwarding is missing or misconfigured, some traffic data may not appear in the Application Command Center (ACC), leading to incomplete insights. Verifying and correctly assigning log forwarding ensures that all relevant network activity is captured and available for analysis.

Question 4

A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to- business (B2B) partners to their data centers.

* The solution must meet these requirements:

* The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.

* The branch locations must have internet filtering and data center connectivity.

* The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports.

* The security team must have access to manage the mobile user and access to branch locations.

* The network team must have access to manage only the partner access.

Which two components can be provisioned to enable data center connectivity over the internet? (Choose two.)

AZTNA Connector

BSD-WAN Connector

CService connections

DColo-Connect

Answer : C, D

Service connections enable secure connectivity between Prisma Access and on-premises data centers, allowing mobile users and branch locations to access internal applications. They facilitate seamless integration of internal networks with Prisma Access while maintaining security policies. Colo-Connect provides a dedicated and optimized pathway for traffic between Prisma Access and data centers, ensuring stable performance and reduced latency over the internet. Both components together support secure and efficient data center connectivity while aligning with the customer's access control and filtering requirements.

Question 5

What must be configured to accurately report an application's availability when onboarding a discovered application for ZTNA Connector?

Aicmp ping

Bhttps ping

Ctcp ping

Dudp ping

Answer : C

When onboarding a discovered application for ZTNA Connector, configuring a TCP ping allows Prisma Access to accurately report the application's availability. TCP ping (also known as a TCP connection check) verifies whether the application's service port is open and responsive, ensuring that the application is reachable before allowing user connections. This method is more reliable than ICMP ping, as many cloud and SaaS applications block ICMP traffic for security reasons.

Question 6

Based on the image below, which two statements describe the reason and action required to resolve the errors? (Choose two.)

AThe client is misconfigured.

BCreate a do not decrypt rule for the hostname ''google.com.''

CThe server has pinned certificates.

DCreate a do not decrypt rule for the hostname ''certificates.godaddy.com.''

Answer : B, C

The error messages indicate that Prisma Access is encountering certificate issues while attempting to decrypt traffic to 'google.com.' This suggests that the server has pinned certificates, meaning it does not allow man-in-the-middle (MITM) decryption by Prisma Access. Since pinned certificates prevent traffic decryption, a solution is to create a 'do not decrypt' rule for the hostname 'google.com.' This will allow traffic to flow without triggering certificate errors while maintaining secure communication with Google's servers.

Question 7

What will cause a connector to fail to establish a connection with the cloud gateway during the deployment of a new ZTNA Connector in a data center?

AThere is a misconfiguration in the DNS settings on the connector.

BThe connector is deployed behind a double NAT.

CThe connector is using a dynamic IP address.

DThere is a high latency in the network connection.

Answer : B

A ZTNA Connector requires a stable and direct connection to the cloud gateway. When the connector is deployed behind a double NAT (Network Address Translation), it can cause issues with reachability and session establishment because the cloud gateway may not be able to properly identify and communicate with the connector. Double NAT can interfere with secure tunneling, IP address resolution, and authentication mechanisms, leading to connection failures. To resolve this, the connector should be placed in a network segment with a single NAT or a public IP assignment.

Palo Alto Networks Security Service Edge Engineer SSE-Engineer Exam Questions