Free Palo Alto Networks Security Service Edge Engineer Exam SSE-Engineer Exam Practice Test

Which overlay protocol must a customer premises equipment (CPE) device support when terminating a Partner Interconnect-based Colo-Connect in Prisma Access?

• Geneve
• IPSec
• GRE
• DTLS

A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to- business (B2B) partners to their data centers.The solution must meet these requirements:The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.The branch locations must have internet filtering and data center connectivity.The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports.The security team must have access to manage the mobile user and access to branch locations. The network team must have access to manage only the partner access.Which two options will allow the engineer to support the requirements? (Choose two.)

• Configure the CPE with Static Routes pointing to Prisma Access Infrastructure and Mobile User routes.
• Enable eBGP for dynamic routing and configure RemoteNetworks.
• Configure Remote Networks and define the branch IP subnets using Static Routes.
• Enable Remote Networks Advertise Default Route.

How can an engineer verify that only the intended changes will be applied when modifying Prisma Access policy configuration in Strata Cloud Manager (SCM)?

• Review the SCM portal for blue circular indicators next to each configuration menu item and ensure only the intended areas of configuration have this indicator.
• Compare the candidate configuration and the most recent version under "Config Version Snapshots/
• Select the most recent job under Operations > Push Status to view the pending changes that would apply to Prisma Access.
• Open the push dialogue in SCM to preview all changes which would be pushed to Prisma Access.

A company has a Prisma Access deployment for mobile users in North America and Europe. Service connections are deployed to the data centers on these continents, and the data centers are connected by private links.With default routing mode, which action will verify that traffic being delivered to mobile users traverses the service connection in the appropriate regions?

• Configure BGP on the customer premises equipment (CPE) to prefer the assigned community string attribute on the mobile user prefixes in its respective Prisma Access region.
• Configure each service connection to filter out the mobile user pool prefixes from the other region in the advertisements to the data center.
• Configure BGP on the customer premises equipment (CPE) to prefer the MED attribute on the mobile user prefixes in its respective Prisma Access region.
• Configure each service connection to prepend the BGP ASN five times for mobile user pool prefixes originating from the other region.

Which feature within Strata Cloud Manager (SCM) allows an operations team to view applications, threats, and user insights for branch locations for both NGFW and Prisma Access simultaneously?

• Command Center
• Log Viewer
• Branch Site Monitor
• SASE Health Dashboard

A malicious user is attempting to connect to a blocked website by crafting a packet using a fake SNI and the correct website in the HTTP host header.Which option will prevent this form of attack?

• Advanced Threat Prevention option to block “Domain Fronting”
• Advanced URL Filtering and block the “Malicious Behavior” category
• Advanced URL Filtering and block “SNI mismatch with Server Certificate (SAN/CN)”
• SSL Decryption to “Block sessions on SNI mismatch with Server Certificate (SAN/CN)”

A user connected to Prisma Access reports that traffic intermittently is denied after matching a Catch-All Deny rule at the bottom and bypassing HIP-based policies. Refreshing VPN connection restores the access.What are two reasons for this behavior? (Choose two.)

• "Collect HIP data' needs to be enabled in the configuration.
• User mapping is learned from sources other than gateway authentication.
• Firewall loses user mapping due to missed HIP report checks.
• HIP-enforced policy is scheduled for certain hours of the day.

When configuring Remote Browser Isolation (RBI) with Prisma Access (Managed by Strata Cloud Manager), which element is required to define the protected URLs for mobile users?

• A URL access management profile with site access set to “Isolate” applied to a Security policy
• A DNS Security profile applied to a Security policy with the action of “Isolate” for the target remote browser DNS categories
• An RBI profile applied to the URL access management profile
• A Security policy with the target URL categories and set the action to “Isolate”

Where are tags applied to control access to Generative AI when implementing AI Access Security?

• To Generative AI applications for identifying sanctioned, tolerated, or unsanctioned applications
• To security rules for defining which types of Generative AI applications are allowed or blocked
• To user devices for identifying and controlling which Generative AI applications they can access
• To Generative AI URL categories for classifying trusted and untrusted Generative AI websites

When a review of devices discovered by IoT Security reveals network routers appearing multiple times with different IP addresses, which configuration will address the issue by showing only unique devices?

• Add the duplicate entries to the ignore list in IoT Security.
• Merge individual devices into a single device with multiple interfaces.
• Create a custom role to merge devices with the same hostname and operating system.
• Delete all duplicate devices, keeping only those discovered using their management IP addresses.