SSE-Engineer Paloalto-Networks Exam Questions and Free Practice Test

Question 7

A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to- business (B2B) partners to their data centers.
* The solution must meet these requirements:
* The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.
* The branch locations must have internet filtering and data center connectivity.
* The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports.
* The security team must have access to manage the mobile user and access to branch locations.
* The network team must have access to manage only the partner access.
Which two components can be provisioned to enable data center connectivity over the internet? (Choose two.)

A. ZTNA Connector

B. SD-WAN Connector

C. Service connections

D. Colo-Connect

Correct Answer:CD

Question 8

Which statement applies when enabling multitenancy in Prisma Access (Managed by Panorama)?

A. Service connection licenses will be assigned only to the first tenant, and these service connections can be shared with the other tenants.

B. A single tenant cannot consist solely of mobile users or solely of remote networks.

C. Each tenant is allocated its own dedicated Prisma Access instances, with compute resources that are not shared across tenants.

D. There is flexibility to manage different tenants using separate Panoramas, which allows for better organization and management of the multiple tenants.

Correct Answer:C

Question 9

An engineer configures a Security policy for traffic originating at branch locations in the Remote Networks configuration scope. After committing the configuration and reviewing the logs, the branch traffic is not matching the Security policy.
Which statement explains the branch traffic behavior?

A. The source address was configured with an address object including the branch location prefixes.

B. The source zone was configured as ??Trust.??

C. The Security policy did not meet best practice standards and was automatically removed.

D. The traffic is matching a Security policy in the Prisma Access configuration scope.

Correct Answer:D

Question 10

A malicious user is attempting to connect to a blocked website by crafting a packet using a fake SNI and the correct website in the HTTP host header.
Which option will prevent this form of attack?

A. Advanced Threat Prevention option to block ??Domain Fronting??

B. Advanced URL Filtering and block the ??Malicious Behavior?? category

C. Advanced URL Filtering and block ??SNI mismatch with Server Certificate (SAN/CN)??

D. SSL Decryption to ??Block sessions on SNI mismatch with Server Certificate (SAN/CN)??

Correct Answer:D

Question 11

How can a network security team be granted full administrative access to a tenant's configuration while restricting access to other tenants by using role-based access control (RBAC) for Panorama Managed Prisma Access in a multitenant environment?

A. Create an Access Domain and restrict access to only the Device Groups and Templates for the Target Tenant.

B. Create a custom role enabling all privileges within the specific tenant's scope and assign it to the security team's user accounts.

C. Create a custom role with Device Group and Template privileges and assign it to the security team's user accounts.

D. Set the administrative accounts for the security team to the "Superuser" role.

Correct Answer:A

Question 12

A company has four branch offices between Canada Central and Canada East which use the same IPSec termination node and have QoS configured with customized bandwidth per site. An engineer wants to onboard a new branch office on the same IPSec termination node.
What is the QoS behavior for the new branch office?

A. Automatically distributed to 25% for each site

B. Unallocated until manually assigned

C. Automatically distributed to 20% for each site

D. Cannot be added to existing QoS configuration

Correct Answer:B

START SSE-Engineer EXAM