SSE-Engineer by Palo Alto Networks Actual Free Exam Q&As

Question 1

An organization deploys the Prisma Access Browser (PAB) to secure web access from diverse endpoints, including personal devices where IT has limited control. To maintain a strong and proactive security posture across these varied environments, why is the use of PAB device posture attributes, such as OS version, file system encryption, and device type, considered essential?

A. It provides the administrators of PAB the ability to enable disk encryption on all endpoints. B. It permits PAB to function as a standalone endpoint detection and response (EDR) solution. C. It enables the administrators of PAB to independently perform OS and browser patching on unmanaged devices. D. It allows administrators to identify and restrict access based on OS version and browser type on unmanaged devices.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 2

Which configuration change will allow an organization using Prisma Access (Managed by Panorama) to minimize the consumption of Strata Logging Service storage due to a high volume of asymmetric traffic flows on its data center?

A. Configure a log forwarding profile on the service connection to filter out asymmetric traffic. B. Disable traffic logging on the service connection. C. Reduce the log retention period for Strata Logging Service. D. Disable the log forwarding profile for the service connection.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 3

An engineer has configured a Web Security rule that restricts access to certain web applications for a specific user group. During testing, the rule does not take effect as expected, and the users can still access blocked web applications. What is a reason for this issue?

A. The rule was created at a lower level in the rule hierarchy, giving priority to a higher-level rule. B. The rule was created with improper threat management settings. C. The rule was created in the wrong scope, affecting only GlobalProtect users instead of all users. D. The rule was created at a higher level in the rule hierarchy, giving priority to a lower-level rule.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

Secure Inbound Access has been configured to allow access to an RDP application at a branch location, as shown in the image below. After a successful commit, return traffic from the application is not reaching the internet user. What is causing the return traffic to fail?

A. The " Allow inbound flows to other Remote Networks over the Prisma Access backbone " checkbox is selected. B. Source NAT is enabled, but the branch location ' s CPE does not have a route back to the Service Endpoint Address of the Inbound Access Remote Network Node. C. Source NAT is enabled, but the branch location ' s CPE does not have a route back to the eBGP Router ID of the Inbound Access Remote Network Node. D. The Remote Network Security policy source zone is configured as " Untrust. "

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 5

During a deployment of Prisma Access (Managed by Strata Cloud Manager) for mobile users, a SAML authentication type and authentication profile in the Cloud Identity Engine application is successfully created.
Using this SAML authentication, what is a valid next step to configure authentication for mobile users?

A. Perform a full commit to Strata Cloud Manager so the Cloud Identity Engine profiles get synchronized from the application. B. In Strata Cloud Manager, create a new authentication type of " Cloud Identity Engine. " C. Create a SAML authentication profile in Strata Cloud Manager and link it to the Cloud Identity Engine profile. D. Permit the Cloud Identity Engine service account RBAC access to the mobile user folder in Strata Cloud Manager.

Discussion 0

Correct Answer: C Vote an answer

Question 6

How can role-based access control (RBAC) for Prisma Access (Managed by Strata Cloud Manager) be used to grant each member of a security team full administrative access to manage the Security policy in a single tenant while restricting access to other tenants in a multitenant deployment?

A. Add the team to the Parent Tenant, select the Prisma Access Configuration Scope, and set the role to Security Administrator. B. Add the team to the Child Tenant, select Prisma Access & NGFW Configuration, and set the role to Security Administrator. C. Add the team to the Parent Tenant, select Prisma Access & NGFW Configuration, and set the role to Security Administrator. D. Add the team to the Child Tenant, select All Apps & Services, and set the role to Security Administrator.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 7

A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to-business (B2B) partners to their data centers. The solution must meet these requirements: The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations. The branch locations must have internet filtering and data center connectivity. The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports. The security team must have access to manage the mobile user and access to branch locations. The network team must have access to manage only the partner access. How should Prisma Access be implemented to meet the customer requirements?

A. Deploy a Prisma Access instance with mobile users, remote networks, and private access for all connection types, and use the Prisma Access Configuration scope to manage all access. B. Deploy two Prisma Access instances - the first with mobile users, remote networks, and private access for all internal connection types, and the second with remote networks and private application access for B2B connections - and use the Strata Multitenant Cloud Manager Prisma Access configuration scope to manage access. C. Deploy two Prisma Access instances - the first with mobile users, remote networks, and private access for all internal connection types, and the second with remote networks and private application access for B2B connections - and use the specific configuration scope for the connection type to manage access. D. Deploy a Prisma Access instance with mobile users, remote networks, and private access for all connection types, and use the specific configuration scope for the connection type to manage access.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 8

A company is migrating from NGFW-hosted Global Protect to Prisma Access Mobile Users. The authentication method will change from LDAP with Windows Active Directory Domain Controllers to SAML with Microsoft Entra ID. After configuring and applying the SAML Authentication Profile to the Mobile Users configuration, the migrated group-based Security policies are no longer functioning. Which User-ID setting must be updated for the group-based Security policies to begin functioning?

A. Configure a redistribution profile to send user-to-group mapping from the Global Protect firewalls to Prisma Access. B. Migrate group mapping to Cloud Identity Engine using an agent to query the Windows Active Directory Domain Controllers. C. Change the SAML Authentication profile Username Modifier to %USERDOMAIN%\% USERINPUT%. D. Modify the group mapping settings by updating the User Attributes to include " userPrincipalName. "

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Palo Alto Networks Security Service Edge Engineer - SSE-Engineer Exam Practice Test