Paloalto Networks SSE Engineer Practice Exams
Last updated on Oct 21,2026- Exam Code: SSE Engineer
- Exam Name: Palo Alto Networks Security Service Edge Engineer
- Certification Provider: Paloalto Networks
- Latest update: Oct 21,2026
Question #1
An engineer has configured a new Remote Networks connection using BGP for route advertisements.
The IPSec tunnel has been established, but the BGP peer is not up.
Which two elements must the engineer validate to solve the issue? (Choose two.)
- A . Secret
- B . MRAI Timers
- C . Peer AS Number
- D . Advertise Default Route Checkbox
Correct Answer: A, C
A, C
Explanation:
The BGP peer not coming up despite an established IPSec tunnel indicates a potential BGP configuration issue.
Secret C If MD5 authentication is configured for BGP, both Prisma Access and the Customer Premises Equipment (CPE) must have the same secret (authentication key). A mismatch will prevent BGP from establishing a session.
Peer AS Number C The Autonomous System (AS) number of the BGP peer must match what is expected on both sides of the connection. If the AS number is incorrect, the BGP session will fail to establish.
By verifying these elements, the engineer can troubleshoot and establish a successful BGP peering session over the IPSec tunnel.
A, C
Explanation:
The BGP peer not coming up despite an established IPSec tunnel indicates a potential BGP configuration issue.
Secret C If MD5 authentication is configured for BGP, both Prisma Access and the Customer Premises Equipment (CPE) must have the same secret (authentication key). A mismatch will prevent BGP from establishing a session.
Peer AS Number C The Autonomous System (AS) number of the BGP peer must match what is expected on both sides of the connection. If the AS number is incorrect, the BGP session will fail to establish.
By verifying these elements, the engineer can troubleshoot and establish a successful BGP peering session over the IPSec tunnel.
Question #2
An engineer configures a Security policy for traffic originating at branch locations in the Remote Networks configuration scope. After committing the configuration and reviewing the logs, the branch traffic is not matching the Security policy.
Which statement explains the branch traffic behavior?
- A . The source address was configured with an address object including the branch location prefixes.
- B . The source zone was configured as “Trust.”
- C . The Security policy did not meet best practice standards and was automatically removed.
- D . The traffic is matching a Security policy in the Prisma Access configuration scope.
Correct Answer: D
D
Explanation:
In Prisma Access, security policies are evaluated based on their configuration scope. If the engineer configured a Security policy under the Remote Networks scope, but traffic from the branch locations is instead matching a Security policy under the Prisma Access configuration scope, the intended policy will not take effect. This happens because Prisma Access evaluates security rules based on the highest-level applicable configuration first, which can override more specific Remote Networks policies.
D
Explanation:
In Prisma Access, security policies are evaluated based on their configuration scope. If the engineer configured a Security policy under the Remote Networks scope, but traffic from the branch locations is instead matching a Security policy under the Prisma Access configuration scope, the intended policy will not take effect. This happens because Prisma Access evaluates security rules based on the highest-level applicable configuration first, which can override more specific Remote Networks policies.
Question #3
What is the purpose of embargo rules in Prisma Access?
- A . Rate-limiting connections originating from specific countries
- B . Allowing traffic only from specific countries
- C . Blocking connections from specific countries
- D . Blocking traffic from Russia. China, and North Korea only
Correct Answer: C
C
Explanation:
Embargo rules in Prisma Access are designed to block traffic from specific countries that are subject to regulatory or policy-based restrictions. These rules help organizations enforce compliance by preventing inbound and outbound connections to or from regions that may pose security risks or are restricted due to legal or geopolitical reasons. They are commonly used to align with government sanctions and corporate security policies.
C
Explanation:
Embargo rules in Prisma Access are designed to block traffic from specific countries that are subject to regulatory or policy-based restrictions. These rules help organizations enforce compliance by preventing inbound and outbound connections to or from regions that may pose security risks or are restricted due to legal or geopolitical reasons. They are commonly used to align with government sanctions and corporate security policies.
Question #4
During a deployment of Prisma Access (Managed by Strata Cloud Manager) for mobile users, a SAML authentication type and authentication profile in the Cloud Identity Engine application is successfully created.
Using this SAML authentication, what is a valid next step to configure authentication for mobile users?
- A . Perform a full commit to Strata Cloud Manager so the Cloud Identity Engine profiles get synchronized from the application.
- B . Permit the Cloud Identity Engine service account RBAC access to the mobile user folder in Strata Cloud Manager.
- C . In Strata Cloud Manager, create a new authentication type of “Cloud Identity Engine.”
- D . Create a SAML authentication profile in Strata Cloud Manager and link it to the Cloud Identity Engine profile.
Correct Answer: D
D
Explanation:
After successfully creating a SAML authentication type and authentication profile in Cloud Identity Engine, the next step is to configure a corresponding SAML authentication profile in Strata Cloud Manager and link it to the Cloud Identity Engine profile. This ensures that Prisma Access (Managed by Strata Cloud Manager) can authenticate mobile users using the configured SAML identity provider (IdP), enabling seamless user authentication and access control.
D
Explanation:
After successfully creating a SAML authentication type and authentication profile in Cloud Identity Engine, the next step is to configure a corresponding SAML authentication profile in Strata Cloud Manager and link it to the Cloud Identity Engine profile. This ensures that Prisma Access (Managed by Strata Cloud Manager) can authenticate mobile users using the configured SAML identity provider (IdP), enabling seamless user authentication and access control.
Question #5
Which feature within Strata Cloud Manager (SCM) allows an operations team to view applications, threats, and user insights for branch locations for both NGFW and Prisma Access simultaneously?
- A . Command Center
- B . Log Viewer
- C . Branch Site Monitor
- D . SASE Health Dashboard
Correct Answer: A
A
Explanation:
The Command Center within Strata Cloud Manager (SCM) provides a centralized view of applications, threats, and user insights across both NGFW (Next-Generation Firewall) and Prisma Access simultaneously. This feature enables the operations team to monitor branch locations, analyze security events, and detect anomalies in real time, offering a comprehensive visibility and threat intelligence interface for proactive network and security management.
A
Explanation:
The Command Center within Strata Cloud Manager (SCM) provides a centralized view of applications, threats, and user insights across both NGFW (Next-Generation Firewall) and Prisma Access simultaneously. This feature enables the operations team to monitor branch locations, analyze security events, and detect anomalies in real time, offering a comprehensive visibility and threat intelligence interface for proactive network and security management.
Question #6
What will cause a connector to fail to establish a connection with the cloud gateway during the deployment of a new ZTNA Connector in a data center?
- A . There is a misconfiguration in the DNS settings on the connector.
- B . The connector is deployed behind a double NAT.
- C . The connector is using a dynamic IP address.
- D . There is a high latency in the network connection.
Correct Answer: B
B
Explanation:
A ZTNA Connector requires a stable and direct connection to the cloud gateway. When the connector is deployed behind a double NAT (Network Address Translation), it can cause issues with reachability and session establishment because the cloud gateway may not be able to properly identify and communicate with the connector. Double NAT can interfere with secure tunneling, IP address resolution, and authentication mechanisms, leading to connection failures. To resolve this, the connector should be placed in a network segment with a single NAT or a public IP assignment.
B
Explanation:
A ZTNA Connector requires a stable and direct connection to the cloud gateway. When the connector is deployed behind a double NAT (Network Address Translation), it can cause issues with reachability and session establishment because the cloud gateway may not be able to properly identify and communicate with the connector. Double NAT can interfere with secure tunneling, IP address resolution, and authentication mechanisms, leading to connection failures. To resolve this, the connector should be placed in a network segment with a single NAT or a public IP assignment.
Question #7
Which statement is valid in relation to certificates used for GlobalProtect and pre-logon?
- A . A public certificate authority (CA) must sign and validate all certificates used.
- B . The certificate used for pre-logon must include both Subject and Subject-Alt fields.
- C . Certificates must be deployed in the Machine Certificate Store.
- D . The GlobalProtect agent may be used to distribute pre-logon certificates.
Correct Answer: C
C
Explanation:
For GlobalProtect with pre-logon, certificates must be installed in the Machine Certificate Store to ensure that authentication occurs before user login. This allows the GlobalProtect client to establish a VPN connection before the user logs in, enabling access to corporate resources such as domain controllers and authentication services. Using machine certificates ensures secure authentication and eliminates dependency on user credentials at the pre-logon stage.
C
Explanation:
For GlobalProtect with pre-logon, certificates must be installed in the Machine Certificate Store to ensure that authentication occurs before user login. This allows the GlobalProtect client to establish a VPN connection before the user logs in, enabling access to corporate resources such as domain controllers and authentication services. Using machine certificates ensures secure authentication and eliminates dependency on user credentials at the pre-logon stage.
Question #8
After configuring domain-based split tunnel for zoom.us, how is expected behavior on the client machine confirmed?
- A . Verify from the routing table.
- B . Enable dump level logs on GlobalProtect Application.
- C . Verify zoom.us is resolved by the tunnel assigned DNS server.
- D . Ping zoom.us from the CLI.
Correct Answer: A
A
Explanation:
After configuring domain-based split tunneling for zoom.us, the expected behavior can be confirmed by checking the routing table on the client machine. If split tunneling is correctly configured, the traffic for zoom.us should be routed outside the GlobalProtect VPN tunnel, while other traffic follows the tunnel path. Reviewing the routing table ensures that only the intended traffic is excluded from the tunnel, confirming that the split tunnel configuration is working as expected.
A
Explanation:
After configuring domain-based split tunneling for zoom.us, the expected behavior can be confirmed by checking the routing table on the client machine. If split tunneling is correctly configured, the traffic for zoom.us should be routed outside the GlobalProtect VPN tunnel, while other traffic follows the tunnel path. Reviewing the routing table ensures that only the intended traffic is excluded from the tunnel, confirming that the split tunnel configuration is working as expected.
Question #9
How can an engineer verify that only the intended changes will be applied when modifying Prisma Access policy configuration in Strata Cloud Manager (SCM)?
- A . Review the SCM portal for blue circular indicators next to each configuration menu item and ensure only the intended areas of configuration have this indicator.
- B . Compare the candidate configuration and the most recent version under "Config Version Snapshots/
- C . Select the most recent job under Operations > Push Status to view the pending changes that would apply to Prisma Access.
- D . Open the push dialogue in SCM to preview all changes which would be pushed to Prisma Access.
Correct Answer: D
D
Explanation:
Palo Alto Networks documentation explicitly states that the "Preview Changes" functionality within
the Strata Cloud Manager (SCM) push dialogue allows engineers to review a detailed summary of all modifications that will be applied to the Prisma Access configuration before committing the changes. This is the primary and most reliable method to ensure only the intended changes are deployed. Let’s analyze why the other options are incorrect based on official documentation:
D
Explanation:
Palo Alto Networks documentation explicitly states that the "Preview Changes" functionality within
the Strata Cloud Manager (SCM) push dialogue allows engineers to review a detailed summary of all modifications that will be applied to the Prisma Access configuration before committing the changes. This is the primary and most reliable method to ensure only the intended changes are deployed. Let’s analyze why the other options are incorrect based on official documentation:
Question #10
A user connected to Prisma Access reports that traffic intermittently is denied after matching a Catch-All Deny rule at the bottom and bypassing HIP-based policies. Refreshing VPN connection restores the access.
What are two reasons for this behavior? (Choose two.)
- A . "Collect HIP data’ needs to be enabled in the configuration.
- B . User mapping is learned from sources other than gateway authentication.
- C . Firewall loses user mapping due to missed HIP report checks.
- D . HIP-enforced policy is scheduled for certain hours of the day.
Correct Answer: B, C
B, C
Explanation:
User mapping learned from sources other than gateway authentication can cause intermittent access issues if it conflicts with the expected user identity used in HIP-based policies. If the firewall is associating the user with an outdated or incorrect mapping, traffic may not match the intended security policies, leading to denials by the Catch-All Deny rule.
If the firewall loses user mapping due to missed HIP report checks, the user may temporarily lose access to policies that require a valid Host Information Profile (HIP) match. When the VPN connection is refreshed, the HIP check is re-initiated, restoring access until the issue repeats.
B, C
Explanation:
User mapping learned from sources other than gateway authentication can cause intermittent access issues if it conflicts with the expected user identity used in HIP-based policies. If the firewall is associating the user with an outdated or incorrect mapping, traffic may not match the intended security policies, leading to denials by the Catch-All Deny rule.
If the firewall loses user mapping due to missed HIP report checks, the user may temporarily lose access to policies that require a valid Host Information Profile (HIP) match. When the VPN connection is refreshed, the HIP check is re-initiated, restoring access until the issue repeats.