Palo Alto Networks Security Service Edge Engineer SSE-Engineer Exam Questions

Page: 1 / 14
Total 50 questions
Question 1

What is the impact of selecting the ''Disable Server Response Inspection'' checkbox after confirming that a Security policy rule has a threat protection profile configured?



Answer : C

Selecting the ''Disable Server Response Inspection'' checkbox means that traffic flowing from the server to the client will not be inspected for threats, even if a threat protection profile is applied to the Security policy rule. This setting can reduce processing overhead but may expose the network to threats embedded in server responses, such as malware or exploits.


Question 2

Where are tags applied to control access to Generative AI when implementing AI Access Security?



Answer : A

When implementing AI Access Security, tags are applied to Generative AI applications to classify them as sanctioned, tolerated, or unsanctioned. This allows organizations to enforce policy-based access control over AI tools, ensuring that only approved applications are accessible while restricting or monitoring usage of untrusted or high-risk AI platforms. This classification helps security teams manage AI-related risks and compliance effectively.


Question 3

A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to- business (B2B) partners to their data centers.

* The solution must meet these requirements:

* The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.

* The branch locations must have internet filtering and data center connectivity.

* The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports.

* The security team must have access to manage the mobile user and access to branch locations.

* The network team must have access to manage only the partner access.

Which two components can be provisioned to enable data center connectivity over the internet? (Choose two.)



Answer : C, D

Service connections enable secure connectivity between Prisma Access and on-premises data centers, allowing mobile users and branch locations to access internal applications. They facilitate seamless integration of internal networks with Prisma Access while maintaining security policies. Colo-Connect provides a dedicated and optimized pathway for traffic between Prisma Access and data centers, ensuring stable performance and reduced latency over the internet. Both components together support secure and efficient data center connectivity while aligning with the customer's access control and filtering requirements.


Question 4

What must be configured to accurately report an application's availability when onboarding a discovered application for ZTNA Connector?



Answer : C

When onboarding a discovered application for ZTNA Connector, configuring a TCP ping allows Prisma Access to accurately report the application's availability. TCP ping (also known as a TCP connection check) verifies whether the application's service port is open and responsive, ensuring that the application is reachable before allowing user connections. This method is more reliable than ICMP ping, as many cloud and SaaS applications block ICMP traffic for security reasons.


Question 5

What will cause a connector to fail to establish a connection with the cloud gateway during the deployment of a new ZTNA Connector in a data center?



Answer : B

A ZTNA Connector requires a stable and direct connection to the cloud gateway. When the connector is deployed behind a double NAT (Network Address Translation), it can cause issues with reachability and session establishment because the cloud gateway may not be able to properly identify and communicate with the connector. Double NAT can interfere with secure tunneling, IP address resolution, and authentication mechanisms, leading to connection failures. To resolve this, the connector should be placed in a network segment with a single NAT or a public IP assignment.


Question 6

Which two actions can a company with Prisma Access deployed take to use the Egress IP API to automate policy rule updates when the IP addresses used by Prisma Access change? (Choose two.)



Answer : A, D

Configuring a webhook allows the company to receive real-time notifications when Prisma Access changes its egress IP addresses, ensuring that policy rules are updated automatically. Downloading a client certificate is necessary for authentication to the Egress IP API, allowing secure API access for retrieving updated IP addresses. These actions ensure that security policies remain effective without manual intervention.


Question 7

Which Cloud Identity Engine capability will create a Security policy that uses Entra ID attributes as the source identification?



Answer : D

The Cloud Dynamic User Group capability in Cloud Identity Engine enables the creation of Security policies that use Entra ID (formerly Azure AD) attributes for user identification. This allows Prisma Access to dynamically apply user-based security rules based on real-time Entra ID attributes, ensuring that access policies adapt to user changes such as group membership, device compliance, or role updates.


Page:    1 / 14   
Total 50 questions