Paloalto Networks SSE Engineer Practice Exams
Last updated on Oct 21,2026- Exam Code: SSE Engineer
- Exam Name: Palo Alto Networks Security Service Edge Engineer
- Certification Provider: Paloalto Networks
- Latest update: Oct 21,2026
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to- business (B2B) partners to their data centers.
* The solution must meet these requirements:
* The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.
* The branch locations must have internet filtering and data center connectivity.
* The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports.
* The security team must have access to manage the mobile user and access to branch locations.
* The network team must have access to manage only the partner access.
Which two components can be provisioned to enable data center connectivity over the internet? (Choose two.)
- A . ZTNA Connector
- B . SD-WAN Connector
- C . Service connections
- D . Colo-Connect
C, D
Explanation:
Service connections enable secure connectivity between Prisma Access and on-premises data centers, allowing mobile users and branch locations to access internal applications. They facilitate seamless integration of internal networks with Prisma Access while maintaining security policies. Colo-Connect provides a dedicated and optimized pathway for traffic between Prisma Access and data centers, ensuring stable performance and reduced latency over the internet. Both components together support secure and efficient data center connectivity while aligning with the customer’s access control and filtering requirements.
All mobile users are unable to authenticate to Prisma Access (Managed by Strata Cloud Manager) using SAML authentication through the Cloud Identity Engine. Users report that after entering their credentials on the Identity Provider (IdP) login page, they are redirected to the Prisma Access portal without successful authentication, and they receive this error message:
Error: Prisma Access Portal Authentication Failed using CIE-SAML with message “400 Bad Request” Which action will identify the root cause of this error?
- A . Verify the SAML metadata configuration in both Strata Cloud Manager and the IdP portal to confirm that the endpoint URLs and certificates are correctly configured.
- B . Examine the Security policy rules in Prisma Access to ensure that traffic from the IdP is allowed and not blocked.
- C . Verify the SAML metadata configuration in both the Cloud Identity Engine and the IdP portal to confirm that the endpoint URLs and certificates are correctly configured.
- D . Review the Authentication logs in Strata Cloud Manager to check for any SAML error messages or authentication failures.
C
Explanation:
The "400 Bad Request" error when attempting SAML authentication through the Cloud Identity Engine (CIE) suggests a misconfiguration in the SAML metadata. This typically occurs when the endpoint URLs, certificates, or entity IDs do not match between Cloud Identity Engine and the IdP portal.
To resolve this, verify that:
– The SAML metadata uploaded to Cloud Identity Engine matches the configuration from the IdP.
– The ACS (Assertion Consumer Service) URL, Entity ID, and certificate are correctly set.
– There are no incorrect or expired certificates in the Cloud Identity Engine and IdP configuration.
By ensuring the SAML metadata is properly configured in both systems, authentication should proceed without errors.
Strata Logging Service is configured to forward logs to an external syslog server; however, a month later, there is a disruption on the syslog server.
Which action will send the missing logs to the external syslog server?
- A . Configure a replay profile with the affected time range and associate it with the affected syslog server profile.
- B . Delete the affected syslog server profile and create a new one.
- C . Export the logs from Strata Logging Service, and then manually import them to the syslog server.
- D . Configure a log filter under the syslog server profile with the affected time range.
A
Explanation:
The Strata Logging Service allows log replay, which enables resending logs that were not successfully forwarded to an external syslog server due to disruptions. By configuring a replay profile with the
affected time range and associating it with the syslog server profile, Prisma Access will resend the missing logs, ensuring that all relevant data is restored in the external logging system. This approach is the most efficient and automated way to recover missing logs.
An engineer has configured a Web Security rule that restricts access to certain web applications for a
specific user group. During testing, the rule does not take effect as expected, and the users can still
access blocked web applications.
What is a reason for this issue?
- A . The rule was created with improper threat management settings.
- B . The rule was created in the wrong scope, affecting only GlobalProtect users instead of all users.
- C . The rule was created at a higher level in the rule hierarchy, giving priority to a lower-level rule.
- D . The rule was created at a lower level in the rule hierarchy, giving priority to a higher-level rule.
D
Explanation:
Prisma Access applies security rules in a hierarchical order, where rules at higher levels take precedence over those at lower levels. If a more permissive rule is placed higher in the hierarchy, it may allow traffic before the restrictive Web Security rule is evaluated. To resolve this, the engineer should reorder the rules to ensure the restrictive Web Security rule is positioned higher in the hierarchy so it is applied before any broader or conflicting rules.
In addition to creating a Security policy, how can an AI Access Security be used to prevent users from uploading financial information to ChatGPT?
- A . Apply File Blocking to stop file uploads containing financial information.
- B . Configure an Enterprise DLP rule to block uploads containing financial information.
- C . Add the ChatGPT domains using URL Filtering to block uploads containing financial information.
- D . Apply a vulnerability profile to stop attempts to exploit system flaws or gain unauthorized access to financial systems.
B
Explanation:
Palo Alto Networks AI Access Security integrates with Enterprise Data Loss Prevention (DLP) capabilities to control sensitive data within AI applications like ChatGPT.
The most effective way to prevent users from uploading financial information is to:
Define an Enterprise DLP rule: This rule would be configured to identify content that matches patterns or keywords associated with financial information (e.g., credit card numbers, bank account details, tax identifiers, financial statements).
Apply the DLP rule to the AI Access Security policy: This policy would be specifically configured to inspect traffic to and from ChatGPT. When the DLP rule detects a user attempting to upload content containing financial information, it can take a defined action, such as blocking the upload. Let’s analyze why the other options are incorrect based on official documentation:
A customer is implementing Prisma Access (Managed by Strata Cloud Manager) to connect mobile users, branch locations, and business-to- business (B2B) partners to their data centers. The solution must meet these requirements:
The mobile users must have internet filtering, data center connectivity, and remote site connectivity to the branch locations.
The branch locations must have internet filtering and data center connectivity.
The B2B partner connections must only have access to specific data center internally developed applications running on non-standard ports.
The security team must have access to manage the mobile user and access to branch locations.
The network team must have access to manage only the partner access.
How should Prisma Access be implemented to meet the customer requirements?
- A . Deploy two Prisma Access instances – the first with mobile users, remote networks, and private access for all internal connection types, and the second with remote networks and private application access for B2B connections – and use the Strata Multitenant Cloud Manager Prisma Access configuration scope to manage access.
- B . Deploy a Prisma Access instance with mobile users, remote networks, and private access for all connection types, and use the Prisma Access Configuration scope to manage all access.
- C . Deploy two Prisma Access instances – the first with mobile users, remote networks, and private access for all internal connection types, and the second with remote networks and private application access for B2B connections – and use the specific configuration scope for the connection type to manage access.
- D . Deploy a Prisma Access instance with mobile users, remote networks, and private access for all connection types, and use the specific configuration scope for the connection type to manage access.
C
Explanation:
To meet the customer’s requirements, two separate Prisma Access instances should be deployed: Instance 1 should include mobile users, remote networks, and private access for internal connectivity. This ensures that mobile users can access the internet, data centers, and remote branch locations while enforcing security policies.
Instance 2 should be configured with remote networks and private application access for B2B connections. This instance will restrict access to only the required internally developed applications using non-standard ports, ensuring that partners cannot access other corporate resources.
By using specific configuration scopes for different connection types, the security team can manage
access to mobile users and branch locations, while the network team can manage B2B partner connections. This ensures proper segmentation of management responsibilities while maintaining security and compliance.
Which overlay protocol must a customer premises equipment (CPE) device support when terminating a Partner Interconnect-based Colo-Connect in Prisma Access?
- A . Geneve
- B . IPSec
- C . GRE
- D . DTLS
B
Explanation:
When terminating a Partner Interconnect-based Colo-Connect in Prisma Access, the Customer Premises Equipment (CPE) must support IPSec as the overlay protocol. Prisma Access establishes secure IPSec tunnels between the Colo-Connect infrastructure and the CPE, ensuring encrypted communication and reliable connectivity. IPSec provides secure site-to-cloud integration, enabling customers to extend their private network securely over the Prisma Access infrastructure.
An engineer deploys a new branch connected to Prisma Access. From the customer premises equipment (CPE) device at the branch, Phase 1 on the tunnel is established, but Phase 2-encrypted packets are not coming back from Prisma Access.
Which Strata Logging Service log facility should the engineer review to determine why Phase 2-encrypted traffic is not being received?
- A . Decrypt logs
- B . System logs
- C . Traffic logs
- D . Tunnel logs
D
Explanation:
Since Phase 1 of the IPSec tunnel is established but Phase 2 traffic is not being received, the Tunnel logs in Strata Logging Service should be reviewed. Tunnel logs provide visibility into IPSec tunnel establishment, Phase 2 negotiation, and any errors or dropped packets related to encrypted traffic. This will help identify whether ESP (Encapsulating Security Payload) traffic is being blocked, mismatched security associations (SAs) exist, or if there are other issues with Prisma Access responding to Phase 2-encrypted packets.
A customer using Prisma Access (Managed by Panorama) wants to monitor traffic patterns across all remote networks and use Strata Logging Service to gather insights on network usage. An engineer notices that some network data is missing from the Application Command Center (ACC).
What should the engineer do to ensure complete data visibility?
- A . Reconfigure the Prisma Access remote networks to log directly to Panorama instead of using Strata Logging Service.
- B . Verify that the Panorama web interface has been configured to aggregate logs from both the Panorama data and RN-SPNs.
- C . Enable the Use Data for Pre-Defined Reports’ setting in the Logging and Reporting configuration on Panorama.
- D . Ensure that log forwarding profiles are applied to all Prisma Access policies and directed to Strata Logging Service.
D
Explanation:
For complete data visibility in Prisma Access (Managed by Panorama), log forwarding profiles must be applied to all security policies to ensure that traffic logs are correctly sent to Strata Logging Service. If log forwarding is missing or misconfigured, some traffic data may not appear in the Application Command Center (ACC), leading to incomplete insights. Verifying and correctly assigning log forwarding ensures that all relevant network activity is captured and available for analysis.
When using the traffic replication feature in Prisma Access, where is the mirrored traffic directed for analysis?
- A . Specified internal security appliance
- B . Dedicated cloud storage location
- C . Panorama
- D . Strata Cloud Manager (SCM)
A
Explanation:
Palo Alto Networks documentation clearly states that when configuring the traffic replication feature in Prisma Access, you must specify an internal security appliance as the destination for the mirrored traffic. This appliance, typically a Palo Alto Networks next-generation firewall or a third-party security tool, is responsible for receiving and analyzing the replicated traffic for various purposes like threat analysis, troubleshooting, or compliance monitoring.
Let’s analyze why the other options are incorrect based on official documentation:
B. Dedicated cloud storage location: While Prisma Access logs and other data might be stored in the cloud, the mirrored traffic for real-time analysis is directly streamed to a designated security appliance, not a passive storage location.
C. Panorama: Panorama is the centralized management system for Palo Alto Networks firewalls. While Panorama can receive logs and manage the configuration of Prisma Access, it is not the direct destination for real-time mirrored traffic intended for immediate analysis.
D. Strata Cloud Manager (SCM): Strata Cloud Manager is the platform used to configure and manage Prisma Access. It facilitates the setup of traffic replication, including specifying the destination appliance, but it does not directly receive or analyze the mirrored traffic itself.
Therefore, the mirrored traffic from the traffic replication feature in Prisma Access is directed to a specified internal security appliance for analysis.