SSE Engineer 시험 - Paloalto Networks실제시험문제와 답 - 80문항

Question No : 1

A customer using Prisma Access (Managed by Panorama) wants to monitor traffic patterns across all remote networks and use Strata Logging Service to gather insights on network usage. An engineer notices that some network data is missing from the Application Command Center (ACC).
What should the engineer do to ensure complete data visibility?

A.Reconfigure the Prisma Access remote networks to log directly to Panorama instead of using Strata Logging Service.
B.Verify that the Panorama web interface has been configured to aggregate logs from both the Panorama data and RN-SPNs.
C.Enable the Use Data for Pre-Defined Reports' setting in the Logging and Reporting configuration on Panorama.
D.Ensure that log forwarding profiles are applied to all Prisma Access policies and directed to Strata Logging Service.

정답:
Explanation:
For complete data visibility in Prisma Access (Managed by Panorama), log forwarding profiles must be applied to all security policies to ensure that traffic logs are correctly sent to Strata Logging Service. If log forwarding is missing or misconfigured, some traffic data may not appear in the Application Command Center (ACC), leading to incomplete insights. Verifying and correctly assigning log forwarding ensures that all relevant network activity is captured and available for analysis.

Question No : 2

A company has four branch offices between Canada Central and Canada East which use the same IPSec termination node and have QoS configured with customized bandwidth per site. An engineer wants to onboard a new branch office on the same IPSec termination node.
What is the QoS behavior for the new branch office?

A.Automatically distributed to 25% for each site
B.Unallocated until manually assigned
C.Automatically distributed to 20% for each site
D.Cannot be added to existing QoS configuration

정답:
Explanation:
When onboarding a new branch office to an existing IPSec termination node in Prisma Access, the QoS bandwidth is not automatically assigned. Instead, the newly added branch remains unallocated until the administrator manually assigns bandwidth within the QoS configuration settings. This ensures that customized bandwidth per site remains intact and allows for fine-tuned traffic management based on business needs.

Question No : 3

Which statement applies when enabling multitenancy in Prisma Access (Managed by Panorama)?

A.Service connection licenses will be assigned only to the first tenant, and these service connections can be shared with the other tenants.
B.A single tenant cannot consist solely of mobile users or solely of remote networks.
C.Each tenant is allocated its own dedicated Prisma Access instances, with compute resources that are not shared across tenants.
D.There is flexibility to manage different tenants using separate Panoramas, which allows for better organization and management of the multiple tenants.

정답:
Explanation:
When multitenancy is enabled in Prisma Access (Managed by Panorama), a key characteristic is the isolation of resources between tenants. Palo Alto Networks documentation emphasizes that each tenant operates within its own logically separate Prisma Access environment. This includes dedicated compute instances, ensuring that the performance and security of one tenant are not impacted by the activities of another.
Let's analyze why the other options are incorrect based on official documentation:
A. Service connection licenses will be assigned only to the first tenant, and these service connections can be shared with the other tenants. This statement is incorrect. In a multitenant Prisma Access deployment, licenses are typically managed and allocated per tenant. While the underlying infrastructure might be shared by Palo Alto Networks, the logical resources and often the licensing are segmented for each tenant. Sharing service connections across completely separate tenants would violate the principle of tenant isolation.
B. A single tenant cannot consist solely of mobile users or solely of remote networks. This statement is incorrect. Prisma Access multitenancy allows for flexibility in how tenants are configured. A tenant can be designed to exclusively serve mobile users, exclusively connect remote networks, or a combination of both, depending on the organizational structure and requirements.
D. There is flexibility to manage different tenants using separate Panoramas, which allows for better organization and management of the multiple tenants. While it is possible to have multiple Panorama instances managing different parts of a large infrastructure, when discussing multitenancy within a single Prisma Access instance (as implied by the question "enabling multitenancy in Prisma Access (Managed by Panorama))", all configured tenants are managed by that single Panorama instance. Managing different tenants with separate Panoramas is a different architectural consideration, not a defining characteristic of enabling multitenancy within one Prisma Access deployment managed by a specific Panorama.
Therefore, the defining characteristic of Prisma Access multitenancy (Managed by Panorama) is the allocation of dedicated Prisma Access instances and compute resources for each tenant, ensuring logical separation and resource isolation

Question No : 4

Which two statements apply when a customer has a large branch office with employees who all arrive and log in within a five-minute time period? (Choose two.)

A.DNS results are only cached for frequently used hostnames.
B.Maximum pending TCP DNS requests is 64.
C.Maximum number of TCP DNS retries is 3.
D.DNS results are cached for 300 seconds.

정답:
Explanation:
When a large branch office experiences a high volume of employees logging in within a short time frame, the following apply:
Maximum pending TCP DNS requests is 64 C This means that Prisma Access can queue up to 64 pending DNS requests over TCP before dropping additional requests. If more requests are received simultaneously, some may fail or experience delays.
Maximum number of TCP DNS retries is 3 C If a DNS request fails over TCP, Prisma Access will attempt to retry the request up to three times before failing over to another method or returning an error.

Question No : 5

Which two configurations must be enabled to allow App Acceleration for SaaS applications? (Choose two.)

A.Acceleration agent for the client machines
B.QoS for user traffic
C.Trusted Root CA for the CA certificate
D.Forward Trust Certificate for the CA certificate

정답:
Explanation:
To enable App Acceleration for SaaS applications in Prisma Access, the following configurations must be enabled:
Trusted Root CA for the CA certificate ensures that Prisma Access can validate and trust the SaaS application's certificates, allowing seamless inspection and acceleration of traffic without security warnings.
Forward Trust Certificate for the CA certificate enables SSL decryption for SaaS applications, allowing Prisma Access to optimize traffic and apply acceleration techniques while maintaining security policies.

Question No : 6

An engineer has configured IPSec tunnels for two remote network locations; however, users are experiencing intermittent connectivity issues across the tunnels.
What action will allow the engineer to receive notifications when the IPSec tunnels are down or experiencing instability?

A.Create a new notification profile specifying conditions for remote network IPSec tunnels.
B.Create a tunnel log notification rule to alert on specified remote network IPSec tunnel conditions.
C.Set up the operational health dashboard to email alerts for remote Network IPSec tunnel issues.
D.Select the IPSec tunnel monitoring and notifications checkbox when configuring the remote network IPSec tunnels.

정답:
Explanation:
In Prisma Access, configuring a notification profile allows engineers to receive alerts when IPSec tunnels experience downtime or instability. By defining specific conditions for remote network IPSec tunnels, the notification profile ensures that the engineer is proactively informed about tunnel failures, flapping, or degraded performance. This approach enables timely troubleshooting and minimizes disruptions for users relying on the IPSec tunnels.

Question No : 7

Which overlay protocol must a customer premises equipment (CPE) device support when terminating a Partner Interconnect-based Colo-Connect in Prisma Access?

A.Geneve
B.IPSec
C.GRE
D.DTLS

정답:
Explanation:
When terminating a Partner Interconnect-based Colo-Connect in Prisma Access, the Customer Premises Equipment (CPE) must support IPSec as the overlay protocol. Prisma Access establishes secure IPSec tunnels between the Colo-Connect infrastructure and the CPE, ensuring encrypted communication and reliable connectivity. IPSec provides secure site-to-cloud integration, enabling customers to extend their private network securely over the Prisma Access infrastructure.

Question No : 8

What is the flow impact of updating the Cloud Services plugin on existing traffic flows in Prisma Access?

A.They will experience latency during the plugin upgrade process.
B.They will automatically terminate when the upgrade begins.
C.They will be unaffected because the plugin upgrade is transparent to users.
D.They will be unaffected only if Panorama is deployed in high availability (HA) mode.

정답:
Explanation:
Updating the Cloud Services plugin in Prisma Access does not disrupt existing traffic flows because the upgrade process is designed to be seamless and transparent. Prisma Access ensures high availability by maintaining active sessions and policies while applying the update in the background. This allows ongoing connections to continue without interruptions, minimizing impact on user experience.

Question No : 9

An engineer configures a Security policy for traffic originating at branch locations in the Remote Networks configuration scope. After committing the configuration and reviewing the logs, the branch traffic is not matching the Security policy.
Which statement explains the branch traffic behavior?

A.The source address was configured with an address object including the branch location prefixes.
B.The source zone was configured as “Trust.”
C.The Security policy did not meet best practice standards and was automatically removed.
D.The traffic is matching a Security policy in the Prisma Access configuration scope.

정답:
Explanation:
In Prisma Access, security policies are evaluated based on their configuration scope. If the engineer configured a Security policy under the Remote Networks scope, but traffic from the branch locations is instead matching a Security policy under the Prisma Access configuration scope, the intended policy will not take effect. This happens because Prisma Access evaluates security rules based on the highest-level applicable configuration first, which can override more specific Remote Networks policies.

Question No : 10

How can role-based access control (RBAC) for Prisma Access (Managed by Strata Cloud Manager) be used to grant each member of a security team full administrative access to manage the Security policy in a single tenant while restricting access to other tenants in a multitenant deployment?

A.Add the team to the Parent Tenant, select the Prisma Access Configuration Scope, and set the role to Security Administrator.
B.Add the team to the Child Tenant, select All Apps & Services, and set the role to Security Administrator.
C.Add the team to the Parent Tenant, select Prisma Access & NGFW Configuration, and set the role to Security Administrator.
D.Add the team to the Child Tenant, select Prisma Access & NGFW Configuration, and set the role to Security Administrator.

정답:
Explanation:
In a multitenant deployment, access control must be configured at the Child Tenant level to ensure that security administrators have full control over Security policy only within their assigned tenant while restricting access to other tenants. By selecting Prisma Access & NGFW Configuration, the assigned users gain full administrative access only for security policy management within the designated tenant, aligning with RBAC best practices for controlled access in Prisma Access Managed by Strata Cloud Manager.

Question No : 11

An intern is tasked with changing the Anti-Spyware Profile used for security rules defined in the GlobalProtect folder. All security rules are using the Default Prisma Profile. The intern reports that the options are greyed out and cannot be modified when selecting the Default Prisma Profile.
Based on the image below, which action will allow the intern to make the required modifications?

A.Request edit access for the GlobalProtect scope.
B.Change the configuration scope to Prisma Access and modify the profile group.
C.Create a new profile, because default profile groups cannot be modified.
D.Modify the existing anti-spyware profile, because best-practice profiles cannot be removed from a group.

정답:
Explanation:
Palo Alto Networks best practices and the behavior of Strata Cloud Manager (SCM) dictate that predefined or default objects, including profile groups like "Default Prisma Profile," cannot be directly modified. These default objects serve as baseline configurations and are often locked to prevent accidental or unintended changes that could impact the overall security posture.
The intern's experience of the options being greyed out when selecting "Default Prisma Profile" is a direct indication of this immutability of default objects. Therefore, the correct action is to:
Create a new Profile Group: The intern should create a new profile group within the appropriate configuration scope (likely GlobalProtect, given the task).
Configure the new Profile Group: In this new profile group, the intern can select the desired Anti-Spyware Profile (which might be an existing custom profile or a new one they create).
Modify Security Rules: The security rules currently using the "Default Prisma Profile" in the GlobalProtect folder need to be modified to use this newly created profile group. Let's analyze why the other options are incorrect based on official documentation:
A. Request edit access for the GlobalProtect scope. While having the correct scope permissions is necessary for making any changes within GlobalProtect, it will not override the inherent immutability of default objects like "Default Prisma Profile." Edit access will allow the intern to create new objects and modify rules, but not directly edit the default profile group.
B. Change the configuration scope to Prisma Access and modify the profile group. The image shows that "Default Prisma Profile" has a "Location" of "Prisma Access." However, even within the Prisma Access scope, default profile groups are generally not directly editable. The issue is not the scope but the fact that it's a default object.
D. Modify the existing anti-spyware profile, because best-practice profiles cannot be removed from a
group. The question is about changing the profile group, not the individual Anti-Spyware Profile. While "best-practice" profiles might be part of default groups, the core issue is the inability to modify the default group itself. Creating a new group allows the intern to choose which Anti-Spyware Profile to include.
In summary, the fundamental principle in Palo Alto Networks management is that default objects are typically read-only to ensure a consistent and predictable baseline. To make changes, you need to create custom objects.

Question No : 12

A large retailer has deployed all of its stores with the same IP address subnet. An engineer is onboarding these stores as Remote Networks in Prisma Access. While onboarding each store, the engineer selects the “Overlapping Subnets” checkbox.
Which Remote Network flow is supported after onboarding in this scenario?

A.To private applications
B.To the internet
C.To remote network
D.To mobile users

정답:
Explanation:
When the "Overlapping Subnets" checkbox is selected during the Remote Network onboarding process in Prisma Access, the deployment enables Private Application access using Prisma Access for Users (ZTNA or Private Access). This feature is designed to handle scenarios where multiple sites use the same IP subnet by leveraging NAT (Network Address Translation) and segmentation to avoid conflicts.
Since overlapping subnets can create routing challenges for direct remote network-to-remote network communication, Prisma Access does not support Remote Network-to-Remote Network or Mobile User communication in this case. Private application access is supported as Prisma Access correctly routes requests based on application-layer intelligence rather than IP-based routing.

Question No : 13

Strata Logging Service is configured to forward logs to an external syslog server; however, a month later, there is a disruption on the syslog server.
Which action will send the missing logs to the external syslog server?

A.Configure a replay profile with the affected time range and associate it with the affected syslog server profile.
B.Delete the affected syslog server profile and create a new one.
C.Export the logs from Strata Logging Service, and then manually import them to the syslog server.
D.Configure a log filter under the syslog server profile with the affected time range.

정답:
Explanation:
The Strata Logging Service allows log replay, which enables resending logs that were not successfully forwarded to an external syslog server due to disruptions. By configuring a replay profile with the
affected time range and associating it with the syslog server profile, Prisma Access will resend the missing logs, ensuring that all relevant data is restored in the external logging system. This approach is the most efficient and automated way to recover missing logs.

Question No : 14

What is the purpose of embargo rules in Prisma Access?

A.Rate-limiting connections originating from specific countries
B.Allowing traffic only from specific countries
C.Blocking connections from specific countries
D.Blocking traffic from Russia. China, and North Korea only

정답:
Explanation:
Embargo rules in Prisma Access are designed to block traffic from specific countries that are subject to regulatory or policy-based restrictions. These rules help organizations enforce compliance by preventing inbound and outbound connections to or from regions that may pose security risks or are restricted due to legal or geopolitical reasons. They are commonly used to align with government sanctions and corporate security policies.

Question No : 15

An engineer configures User-ID redistribution from an on-premises firewall connected to Prisma Access (Managed by Panorama) using a service connection. After committing the configuration, traffic from remote network connections is still not matching the correct user-based policies.
Which two configurations need to be validated? (Choose two.)

A.Ensure the Remote_Network_Template is selected when adding the User-ID Agent in Panorama.
B.Confirm there is a Security policy configured in Prisma Access to allow the communication on port 5007.
C.Confirm the Collector Pre-Shared Keys match between Prisma Access and the on-premises firewall.
D.Ensure the Service_Conn_Template is selected when adding the User-ID Agent in Panorama.

정답:
Explanation:
Ensuring that the Remote_Network_Template is selected when adding the User-ID Agent in Panorama is crucial because User-ID information must be associated with the correct Remote Network configuration for policies to apply properly. Additionally, the Service_Conn_Template must be selected when adding the User-ID Agent in Panorama, as the service connection is responsible for distributing User-ID mappings between the on-premises firewall and Prisma Access. If either of these configurations is incorrect, the user information will not be properly mapped, and traffic will not match user-based policies.

Paloalto Networks SSE Engineer 시험