Paloalto Networks SSE Engineer Practice Exams
Last updated on Oct 21,2026- Exam Code: SSE Engineer
- Exam Name: Palo Alto Networks Security Service Edge Engineer
- Certification Provider: Paloalto Networks
- Latest update: Oct 21,2026
Question #11
A malicious user is attempting to connect to a blocked website by crafting a packet using a fake SNI
and the correct website in the HTTP host header.
Which option will prevent this form of attack?
- A . Advanced Threat Prevention option to block “Domain Fronting”
- B . Advanced URL Filtering and block the “Malicious Behavior” category
- C . Advanced URL Filtering and block “SNI mismatch with Server Certificate (SAN/CN)”
- D . SSL Decryption to “Block sessions on SNI mismatch with Server Certificate (SAN/CN)”
Correct Answer: D
D
Explanation:
This option ensures that SSL Decryption checks for mismatches between the Server Name Indication (SNI) field in the TLS handshake and the Common Name (CN) or Subject Alternative Name (SAN) in the server certificate. If a malicious user tries to bypass content filtering by spoofing the SNI while using the real blocked website in the HTTP host header, this setting will detect the discrepancy and block the session, preventing unauthorized access.
D
Explanation:
This option ensures that SSL Decryption checks for mismatches between the Server Name Indication (SNI) field in the TLS handshake and the Common Name (CN) or Subject Alternative Name (SAN) in the server certificate. If a malicious user tries to bypass content filtering by spoofing the SNI while using the real blocked website in the HTTP host header, this setting will detect the discrepancy and block the session, preventing unauthorized access.
Question #12
When configuring Remote Browser Isolation (RBI) with Prisma Access (Managed by Strata Cloud Manager), which element is required to define the protected URLs for mobile users?
- A . A URL access management profile with site access set to “Isolate” applied to a Security policy
- B . A DNS Security profile applied to a Security policy with the action of “Isolate” for the target remote browser DNS categories
- C . An RBI profile applied to the URL access management profile
- D . A Security policy with the target URL categories and set the action to “Isolate”
Correct Answer: A
A
Explanation:
When configuring Remote Browser Isolation (RBI) in Prisma Access (Managed by Strata Cloud Manager) for mobile users, a URL access management profile must be created with the site access action set to "Isolate". This profile is then applied to a Security policy to enforce isolation for specific URLs. This ensures that web traffic to designated high-risk or untrusted sites is redirected to a remote, secure browser instance, protecting endpoints from potential web-based threats.
A
Explanation:
When configuring Remote Browser Isolation (RBI) in Prisma Access (Managed by Strata Cloud Manager) for mobile users, a URL access management profile must be created with the site access action set to "Isolate". This profile is then applied to a Security policy to enforce isolation for specific URLs. This ensures that web traffic to designated high-risk or untrusted sites is redirected to a remote, secure browser instance, protecting endpoints from potential web-based threats.
Question #13
In an Explicit Proxy deployment where no agent can be used on the endpoint, which authentication method is supported with mobile users?
- A . LDAP
- B . Kerberos
- C . SAML
- D . SSO
Correct Answer: C
C
Explanation:
In an Explicit Proxy deployment where no agent can be used on the endpoint, SAML (Security Assertion Markup Language) is the supported authentication method for mobile users. SAML allows authentication via an Identity Provider (IdP) without requiring an agent on the endpoint, making it ideal for web-based authentication in cloud and remote access environments. It enables Single Sign-On (SSO) and secure authentication without direct integration with LDAP or Kerberos, which typically require an agent or local network presence.
C
Explanation:
In an Explicit Proxy deployment where no agent can be used on the endpoint, SAML (Security Assertion Markup Language) is the supported authentication method for mobile users. SAML allows authentication via an Identity Provider (IdP) without requiring an agent on the endpoint, making it ideal for web-based authentication in cloud and remote access environments. It enables Single Sign-On (SSO) and secure authentication without direct integration with LDAP or Kerberos, which typically require an agent or local network presence.
Question #14
When a review of devices discovered by IoT Security reveals network routers appearing multiple times with different IP addresses, which configuration will address the issue by showing only unique devices?
- A . Add the duplicate entries to the ignore list in IoT Security.
- B . Merge individual devices into a single device with multiple interfaces.
- C . Create a custom role to merge devices with the same hostname and operating system.
- D . Delete all duplicate devices, keeping only those discovered using their management IP addresses.
Correct Answer: B
B
Explanation:
When network routers appear multiple times with different IP addresses in IoT Security, it is likely because they have multiple interfaces with separate IPs. Merging these entries into a single device with multiple interfaces ensures that the system correctly identifies each router as a unique entity while maintaining visibility across all its interfaces. This approach prevents unnecessary duplicates, improves asset management, and enhances security monitoring.
B
Explanation:
When network routers appear multiple times with different IP addresses in IoT Security, it is likely because they have multiple interfaces with separate IPs. Merging these entries into a single device with multiple interfaces ensures that the system correctly identifies each router as a unique entity while maintaining visibility across all its interfaces. This approach prevents unnecessary duplicates, improves asset management, and enhances security monitoring.
Question #15
Which advanced AI-powered functionality does Strata Copilot provide to enhance the capabilities of Prisma Access security teams?
- A . Real-time traffic analysis for automated threat prevention
- B . Initial configuration of Prisma Access using a natural language interface
- C . Customized guidance for resolving issues through recommended next steps
- D . Automated remediation of misconfigured security policies
Correct Answer: C
C
Explanation:
Strata Copilot enhances the capabilities of Prisma Access security teams by providing AI-powered insights and recommendations to help resolve security issues efficiently. It analyzes security events, misconfigurations, and alerts and offers contextual guidance with recommended next steps for troubleshooting and improving security posture. This assists teams in quickly identifying and addressing security challenges without requiring deep manual investigation.
C
Explanation:
Strata Copilot enhances the capabilities of Prisma Access security teams by providing AI-powered insights and recommendations to help resolve security issues efficiently. It analyzes security events, misconfigurations, and alerts and offers contextual guidance with recommended next steps for troubleshooting and improving security posture. This assists teams in quickly identifying and addressing security challenges without requiring deep manual investigation.
Question #16
A large retailer has deployed all of its stores with the same IP address subnet. An engineer is onboarding these stores as Remote Networks in Prisma Access. While onboarding each store, the engineer selects the “Overlapping Subnets” checkbox.
Which Remote Network flow is supported after onboarding in this scenario?
- A . To private applications
- B . To the internet
- C . To remote network
- D . To mobile users
Correct Answer: A
A
Explanation:
When the "Overlapping Subnets" checkbox is selected during the Remote Network onboarding process in Prisma Access, the deployment enables Private Application access using Prisma Access for Users (ZTNA or Private Access). This feature is designed to handle scenarios where multiple sites use the same IP subnet by leveraging NAT (Network Address Translation) and segmentation to avoid conflicts.
Since overlapping subnets can create routing challenges for direct remote network-to-remote network communication, Prisma Access does not support Remote Network-to-Remote Network or Mobile User communication in this case. Private application access is supported as Prisma Access correctly routes requests based on application-layer intelligence rather than IP-based routing.
A
Explanation:
When the "Overlapping Subnets" checkbox is selected during the Remote Network onboarding process in Prisma Access, the deployment enables Private Application access using Prisma Access for Users (ZTNA or Private Access). This feature is designed to handle scenarios where multiple sites use the same IP subnet by leveraging NAT (Network Address Translation) and segmentation to avoid conflicts.
Since overlapping subnets can create routing challenges for direct remote network-to-remote network communication, Prisma Access does not support Remote Network-to-Remote Network or Mobile User communication in this case. Private application access is supported as Prisma Access correctly routes requests based on application-layer intelligence rather than IP-based routing.
Question #17
How can a network security team be granted full administrative access to a tenant’s configuration while restricting access to other tenants by using role-based access control (RBAC) for Panorama Managed Prisma Access in a multitenant environment?
- A . Create an Access Domain and restrict access to only the Device Groups and Templates for the Target Tenant.
- B . Create a custom role enabling all privileges within the specific tenant’s scope and assign it to the security team’s user accounts.
- C . Create a custom role with Device Group and Template privileges and assign it to the security team’s user accounts.
- D . Set the administrative accounts for the security team to the "Superuser" role.
Correct Answer: A
A
Explanation:
In a Panorama Managed Prisma Access multitenant environment, Access Domains provide granular role-based access control (RBAC). By defining an Access Domain, the network security team can be granted full administrative privileges for a specific tenant’s configuration while ensuring they cannot access or modify other tenants. This method enforces proper segmentation and ensures compliance with multitenant security policies.
A
Explanation:
In a Panorama Managed Prisma Access multitenant environment, Access Domains provide granular role-based access control (RBAC). By defining an Access Domain, the network security team can be granted full administrative privileges for a specific tenant’s configuration while ensuring they cannot access or modify other tenants. This method enforces proper segmentation and ensures compliance with multitenant security policies.
Question #18
Which policy configuration in Prisma Access Browser (PAB) will protect an organization from malicious BYOD and minimize the impact on the user experience?
- A . One that blocks file exchange
- B . One for session recording
- C . One that blocks elements such as screen scrapers
- D . One that allows access to applications with data masking or watermarking
Correct Answer: D
D
Explanation:
In Prisma Access Browser (PAB), allowing access to applications while enforcing data masking or watermarking provides security for BYOD (Bring Your Own Device) users without heavily impacting the user experience. Data masking ensures that sensitive information is obscured, reducing the risk of data leakage, while watermarking can deter unauthorized screenshots or data exfiltration. This approach balances security and usability, allowing users to work efficiently while protecting corporate data.
D
Explanation:
In Prisma Access Browser (PAB), allowing access to applications while enforcing data masking or watermarking provides security for BYOD (Bring Your Own Device) users without heavily impacting the user experience. Data masking ensures that sensitive information is obscured, reducing the risk of data leakage, while watermarking can deter unauthorized screenshots or data exfiltration. This approach balances security and usability, allowing users to work efficiently while protecting corporate data.
Question #19
An engineer configures User-ID redistribution from an on-premises firewall connected to Prisma Access (Managed by Panorama) using a service connection. After committing the configuration, traffic from remote network connections is still not matching the correct user-based policies.
Which two configurations need to be validated? (Choose two.)
- A . Ensure the Remote_Network_Template is selected when adding the User-ID Agent in Panorama.
- B . Confirm there is a Security policy configured in Prisma Access to allow the communication on port 5007.
- C . Confirm the Collector Pre-Shared Keys match between Prisma Access and the on-premises firewall.
- D . Ensure the Service_Conn_Template is selected when adding the User-ID Agent in Panorama.
Correct Answer: A, D
A, D
Explanation:
Ensuring that the Remote_Network_Template is selected when adding the User-ID Agent in Panorama is crucial because User-ID information must be associated with the correct Remote Network configuration for policies to apply properly. Additionally, the Service_Conn_Template must be selected when adding the User-ID Agent in Panorama, as the service connection is responsible for distributing User-ID mappings between the on-premises firewall and Prisma Access. If either of these configurations is incorrect, the user information will not be properly mapped, and traffic will not match user-based policies.
A, D
Explanation:
Ensuring that the Remote_Network_Template is selected when adding the User-ID Agent in Panorama is crucial because User-ID information must be associated with the correct Remote Network configuration for policies to apply properly. Additionally, the Service_Conn_Template must be selected when adding the User-ID Agent in Panorama, as the service connection is responsible for distributing User-ID mappings between the on-premises firewall and Prisma Access. If either of these configurations is incorrect, the user information will not be properly mapped, and traffic will not match user-based policies.
Question #20
What is the flow impact of updating the Cloud Services plugin on existing traffic flows in Prisma Access?
- A . They will experience latency during the plugin upgrade process.
- B . They will automatically terminate when the upgrade begins.
- C . They will be unaffected because the plugin upgrade is transparent to users.
- D . They will be unaffected only if Panorama is deployed in high availability (HA) mode.
Correct Answer: C
C
Explanation:
Updating the Cloud Services plugin in Prisma Access does not disrupt existing traffic flows because the upgrade process is designed to be seamless and transparent. Prisma Access ensures high availability by maintaining active sessions and policies while applying the update in the background. This allows ongoing connections to continue without interruptions, minimizing impact on user experience.
C
Explanation:
Updating the Cloud Services plugin in Prisma Access does not disrupt existing traffic flows because the upgrade process is designed to be seamless and transparent. Prisma Access ensures high availability by maintaining active sessions and policies while applying the update in the background. This allows ongoing connections to continue without interruptions, minimizing impact on user experience.